AlpcpCaptureHandleAttributeInternal

INT64 __fastcall AlpcpCaptureHandleAttributeInternal(CHAR *a1, INT64 a2){
  CHAR *v2; 
  CHAR v3; 
  __int64 v4; 
  CHAR *v5; 
  CHAR *PoolWithTag; 
  CHAR *Blob; 
  _EPROCESS *v8; 
  NTSTATUS v9; 
  __int64 j; 
  int v11; 
  unsigned __int64 v13; 
  __int64 v14; 
  __int64 i; 
  CHAR *v16; 
  _DWORD *v17; 
  CHAR PreviousMode; 
  __int64 v20; 
  v2 = a1;
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  PreviousMode = v3;
  if( (*(_DWORD *)a1 & 0xFFF0FFFF) != 0 )
    return 3221225485i64;
  LODWORD(v4) = 1;
  v5 = 0i64;
  PoolWithTag = 0i64;
  if( (*(_DWORD *)a1 & 0x40000) != 0 )
  {
    v4 = *((unsigned int *)a1 + 4);
    if( (unsigned int)v4 > 0x200 )
      return 3221227298i64;
    if( (unsigned int)v4 > 1 )
    {
      PoolWithTag = (CHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, 24 * v4, 0x4863704Cui64);
      if( !PoolWithTag )
        return 3221225495i64;
      v13 = *((_QWORD *)v2 + 1);
      if( *((_BYTE *)KeGetCurrentThread() + 562) )
      {
        v14 = 16i64 * (unsigned int)v4;
        if( v14 )
        {
          if( (v13 & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          if( v14 + v13 > 0x7FFFFFFF0000i64 || v14 + v13 < v13 )
            MEMORY[0x7FFFFFFF0000] = 0;
        }
      }
      for( i = 0i64; (unsigned int)i < (unsigned int)v4; i = (unsigned int)(i + 1) )
      {
        v16 = &PoolWithTag[24 * i];
        v17 = (_DWORD *)(v13 + 16i64 * (unsigned int)i);
        *(_DWORD *)v16 = *v17;
        *((_QWORD *)v16 + 1) = (unsigned int)v17[1];
        *((_DWORD *)v16 + 4) = v17[2];
        *((_DWORD *)v16 + 5) = v17[3];
        if( (*(_DWORD *)v16 & 0xFFF4FFFF) != 0 )
        {
          v9 = -1073741811;
          goto LABEL_12;
        }
      }
      v2 = PoolWithTag;
      goto LABEL_3;
    }
    return 3221225485i64;
  }
LABEL_3:
  Blob = AlpcpAllocateBlob(&AlpcHandleDataType, 48i64 * (unsigned int)v4, 0i64);
  v5 = Blob;
  if( Blob )
  {
    memset((INT64)Blob, 0i64);
    *((_DWORD *)v5 + 1) = v4;
    if( v3 )
      v8 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
    else
      v8 = (_EPROCESS *)PsInitialSystemProcess;
    v9 = 0;
    for( j = 0i64; ; j = (unsigned int)(j + 1) )
    {
      if( (unsigned int)j >= (unsigned int)v4 )
      {
        *(_QWORD *)(a2 + 48) = v5;
        v5 = 0i64;
        goto LABEL_12;
      }
      v20 = 48 * j;
      v9 = ObCaptureObjectStateForDuplication(
             v8,
             *(PVOID *)&v2[24 * j + 8],
             *(unsigned int *)&v2[24 * j + 20],
             (*(_DWORD *)&v2[24 * j] & 0x10000 | 0x40000u) >> 15,
             PreviousMode,
             (_OB_DUPLICATE_OBJECT_STATE *)&v5[48 * j + 8]);
      if( v9 >= 0 )
      {
        v11 = *(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(*(_QWORD *)&v5[v20 + 24]
                                                                                                - 24i64) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(*(_QWORD *)&v5[v20 + 24] - 48) >> 8)]
                        + 68);
        *(_DWORD *)&v5[v20] = v11;
        if( (v11 & 0xFFD) == 0 )
          break;
      }
    }
    v9 = -1073741790;
  }
  else
  {
    v9 = -1073741670;
  }
LABEL_12:
  if( v5 )
    AlpcpDereferenceBlobEx(v5, 1i64);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x4863704Cu);
  return(unsigned int)v9;
}

Referenced by: