PspApplyMitigationOptions
VOID __fastcall PspApplyMitigationOptions(){
__int64 v0;
__int64 v1;
__m128i *v2;
__int64 v3;
__int64 v4;
__int64 v5;
unsigned __int64 v6;
__m128i *v7;
unsigned __int64 v8;
__int64 v9;
__m128i v10;
__int128 v11;
unsigned __int64 v12;
bool v13;
_HANDLE_TABLE *v14;
unsigned int v15;
unsigned int v16;
unsigned __int64 v17;
unsigned __int8 v18;
int v19;
__int64 v20;
char v21;
int v22;
int v23;
unsigned __int64 v24;
char v25;
unsigned __int64 v26;
UINT64 MitigationOptions[2];
unsigned __int64 v28;
__m128i v29;
unsigned __int64 v30;
__int128 v31;
unsigned __int64 v32;
int v33;
v4 = *(_QWORD *)(v1 + 1408);
v5 = v1;
v6 = v2[1].m128i_u64[0];
v7 = v2;
v8 = *(_QWORD *)(v3 + 16);
v9 = v0;
v30 = v6;
v32 = v8;
v10 = *v2;
v11 = *(_OWORD *)v3;
v29 = *v2;
v31 = v11;
if( v4 && *(_WORD *)(v4 + 8) == 332 )
{
*(__m128i *)MitigationOptions = v10;
v28 = v6;
*(_BYTE *)(v1 + 643) = PspDecodeMitigationExecuteOptions((UINT64)MitigationOptions);
}
v12 = v29.m128i_i64[0];
if( (((unsigned __int64)v29.m128i_i64[0] >> 8) & 3) != 1 )
{
if( (((unsigned __int64)v29.m128i_i64[0] >> 8) & 3) != 3 )
goto LABEL_8;
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 8u);
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x10u);
v12 = v29.m128i_i64[0];
LABEL_8:
if( (v12 & 0x30000) != 0 )
v13 = (BYTE2(v12) & 3) == 2;
else
v13 = (v33 & 1) == 0;
if( v13 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x40u);
v12 = v29.m128i_i64[0];
}
if( (*(_DWORD *)(v5 + 2512) & 0x40) == 0 )
{
if( ((v12 >> 20) & 3) != 0 )
{
if( ((v12 >> 20) & 3) != 1 )
goto LABEL_19;
}
else if( (v33 & 2) == 0 )
{
goto LABEL_19;
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x20u);
v12 = v29.m128i_i64[0];
}
LABEL_19:
if( !v9 )
goto LABEL_28;
if( ((v12 >> 24) & 3) == 0 )
{
if( (v33 & 4) == 0 )
goto LABEL_26;
LABEL_24:
v14 = (_HANDLE_TABLE *)ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v5);
if( v14 )
{
ExEnableHandleExceptions(v14, 1u);
ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v5 + 1112));
}
goto LABEL_26;
}
if( ((v12 >> 24) & 3) == 1 )
goto LABEL_24;
LABEL_26:
if( (*(_DWORD *)(v9 + 2512) & 0x1000) != 0 )
{
v12 = v12 & 0xFFFFFFFFCFFFFFFFui64 | 0x10000000;
v29.m128i_i64[0] = v12;
}
LABEL_28:
if( ((v12 >> 28) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x3000u);
v12 = v29.m128i_i64[0];
}
v15 = 0x2000;
if( (*(_DWORD *)(v5 + 2512) & 0x1000) == 0 && (((unsigned __int64)v31 >> 28) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x2000u);
v12 = v29.m128i_i64[0];
}
if( ((v12 >> 36) & 3) != 1 )
{
if( ((v12 >> 36) & 3) != 3 )
goto LABEL_37;
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x200u);
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x900u);
v12 = v29.m128i_i64[0];
LABEL_37:
v16 = 1024;
v29.m128i_i64[1] = _mm_srli_si128(_mm_loadu_si128(&v29), 8).m128i_u64[0];
if( (v29.m128i_i8[15] & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x400u);
v12 = v29.m128i_i64[0];
}
if( (*(_DWORD *)(v5 + 2512) & 0x100) != 0 )
{
v29.m128i_i64[1] = v29.m128i_i64[1] & 0xFFFFFFFFFCCCFFFFui64 | 0x2220000;
*((_QWORD *)&v31 + 1) = *((_QWORD *)&v31 + 1) & 0xFFFFFFFFFCCCFFFFui64 | 0x2220000;
}
else if( (((unsigned __int64)v31 >> 36) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x800u);
v12 = v29.m128i_i64[0];
}
if( (BYTE4(v12) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x80u);
v12 = v29.m128i_i64[0];
}
switch( (v12 >> 40) & 3 )
{
case 0ui64:
if( (v33 & 8) == 0 )
break;
v17 = v12 & 0xFFFFFCFFFFFFFFFFui64 | 0x10000000000i64;
v29.m128i_i64[0] = v17;
if( (v33 & 0x20) != 0 && !PspDisableControlFlowGuardExportSuppression )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 2u);
v29.m128i_i64[0] = v17 | 0x30000000000i64;
}
LABEL_57:
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 1u);
if( (v33 & 0x10) == 0 )
_interlockedbittestandset((volatile signed __int32 *)(v5 + 632), 5u);
goto LABEL_59;
case 1ui64:
goto LABEL_57;
case 3ui64:
if( PspDisableControlFlowGuardExportSuppression )
{
v29.m128i_i64[0] = v12 & 0xFFFFFCFFFFFFFFFFui64 | 0x10000000000i64;
}
else
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 2u);
v29.m128i_i64[0] |= 0x30000000000ui64;
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 1u);
if( (v33 & 0x10) == 0 )
KeSetCheckStackExtentsProcess(v5, 1);
LABEL_59:
v12 = v29.m128i_i64[0];
break;
}
if( (((unsigned __int64)v29.m128i_i64[1] >> 8) & 3) == 1 && (*(_DWORD *)(v5 + 2512) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 4u);
v12 = v29.m128i_i64[0];
}
if( ((v12 >> 44) & 3) == 1 )
{
if( *(_BYTE *)(v5 + 2168) < 8u )
*(_BYTE *)(v5 + 2168) = 8;
if( *(_BYTE *)(v5 + 2169) < 8u )
*(_BYTE *)(v5 + 2169) = 8;
}
else
{
if( ((v12 >> 44) & 3) != 3 )
goto LABEL_74;
if( *(_BYTE *)(v5 + 2168) < 6u )
*(_BYTE *)(v5 + 2168) = 6;
if( *(_BYTE *)(v5 + 2169) < 6u )
*(_BYTE *)(v5 + 2169) = 6;
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x800000u);
v12 = v29.m128i_i64[0];
LABEL_74:
if( (*(_DWORD *)(v5 + 2512) & 0x800000) == 0 )
{
if( (((unsigned __int64)v31 >> 44) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x1000000u);
goto LABEL_79;
}
if( (((unsigned __int64)v31 >> 44) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x2000000u);
LABEL_79:
v12 = v29.m128i_i64[0];
}
}
v18 = v29.m128i_i8[0];
if( (((unsigned __int8)v29.m128i_i8[0] >> 4) & 3) == 0 && (*(_DWORD *)(v5 + 2512) & 1) != 0 )
{
v12 = v12 & 0xFFFFFFFFFFFFFFCFui64 | 0x10;
v29.m128i_i64[0] = v12;
v18 = v12;
}
if( ((v18 >> 4) & 3) != 1 && (((unsigned __int64)v31 >> 4) & 3) == 1 )
{
v12 |= 0x30ui64;
v29.m128i_i64[0] = v12;
}
if( (v33 & 0x30000) == 0x10000 )
{
v12 = v12 & 0xFFFCFFFFFFFFFFFFui64 | 0x1000000000000i64;
LABEL_91:
v29.m128i_i64[0] = v12;
goto LABEL_92;
}
if( (v33 & 0x30000) == 196608 && (BYTE6(v12) & 3) != 1 )
{
v12 |= 0x3000000000000ui64;
goto LABEL_91;
}
LABEL_92:
if( (HIWORD(v12) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x10000u);
goto LABEL_96;
}
if( (HIWORD(v12) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x20000u);
LABEL_96:
v12 = v29.m128i_i64[0];
}
if( (*(_DWORD *)(v5 + 2512) & 0x30000) == 0 && (WORD3(v31) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x20000u);
v12 = v29.m128i_i64[0];
}
if( v9 && (*(_DWORD *)(v9 + 2512) & 0x80000) != 0 )
{
v12 = v12 & 0xFFCFFFFFFFFFFFFFui64 | 0x10000000000000i64;
v29.m128i_i64[0] = v12;
}
if( ((v12 >> 52) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x80000u);
v12 = v29.m128i_i64[0];
}
if( (*(_DWORD *)(v5 + 2512) & 0x80000) == 0 && (((unsigned __int64)v31 >> 52) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x100000u);
v12 = v29.m128i_i64[0];
}
if( v9 && (*(_DWORD *)(v9 + 2512) & 0x200000) != 0 )
{
v12 = v12 & 0xFCFFFFFFFFFFFFFFui64 | 0x100000000000000i64;
v29.m128i_i64[0] = v12;
}
if( (HIBYTE(v12) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x200000u);
v12 = v29.m128i_i64[0];
}
if( (*(_DWORD *)(v5 + 2512) & 0x200000) == 0 && (BYTE7(v31) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x400000u);
v12 = v29.m128i_i64[0];
}
if( v9 && (*(_DWORD *)(v9 + 2512) & 0x40000) != 0 )
{
v12 = v12 & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
v29.m128i_i64[0] = v12;
}
if( ((v12 >> 60) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x40000u);
if( v9 )
{
v19 = *(_DWORD *)(v9 + 2512);
if( (v19 & 0x4000000) != 0 )
{
v29.m128i_i64[1] = v29.m128i_i64[1] & 0xFFFFFFFFFFFFFFCFui64 | 0x10;
}
else if( (v19 & 0x8000000) != 0 )
{
v29.m128i_i64[1] |= 0x30ui64;
}
}
if( (((unsigned __int64)v29.m128i_i64[1] >> 4) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0xC000000u);
}
else if( (((unsigned __int64)v29.m128i_i64[1] >> 4) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x8000000u);
}
if( (*(_DWORD *)(v5 + 2512) & 0xC000000) == 0 && ((*((_QWORD *)&v31 + 1) >> 4) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x8000000u);
if( (((unsigned __int64)v29.m128i_i64[1] >> 28) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 1u);
if( (*(_DWORD *)(v5 + 2516) & 1) == 0 && ((*((_QWORD *)&v31 + 1) >> 28) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 2u);
if( (v29.m128i_i8[12] & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 4u);
if( (HIWORD(v29.m128i_i64[1]) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x40000000u);
if( (((unsigned __int64)v29.m128i_i64[1] >> 52) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), v15);
if( (*(_DWORD *)(v5 + 2516) & 4) == 0 && (BYTE12(v31) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 8u);
if( (((unsigned __int64)v29.m128i_i64[1] >> 40) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), v16);
if( (v16 & *(_DWORD *)(v5 + 2516)) == 0 && ((*((_QWORD *)&v31 + 1) >> 40) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x800u);
if( (((unsigned __int64)v29.m128i_i64[1] >> 16) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x10u);
if( (*(_DWORD *)(v5 + 2516) & 0x10) == 0 && ((*((_QWORD *)&v31 + 1) >> 16) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x20u);
v20 = *(_QWORD *)(v5 + 1408);
if( v20 && *(_WORD *)(v20 + 8) == 332 )
{
if( (((unsigned __int64)v29.m128i_i64[1] >> 20) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x40u);
if( (*(_DWORD *)(v5 + 2516) & 0x40) == 0 && ((*((_QWORD *)&v31 + 1) >> 20) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x80u);
if( (((unsigned __int64)v29.m128i_i64[1] >> 24) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x100u);
if( (*(_DWORD *)(v5 + 2516) & 0x100) == 0 && ((*((_QWORD *)&v31 + 1) >> 24) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x200u);
}
v21 = (unsigned __int64)v29.m128i_i64[1] >> 36;
if( (v21 & 3) == 1 )
{
v22 = 1;
goto LABEL_173;
}
if( (((unsigned __int64)v29.m128i_i64[1] >> 36) & 3) == 3 )
{
v22 = 2;
LABEL_173:
PspSetNoChildProcessRestrictedPolicy(v5, v22);
}
if( (v21 & 3) != 1 && ((*((_QWORD *)&v31 + 1) >> 36) & 3) == 1 )
PspSetNoChildProcessRestrictedPolicy(v5, 3);
if( v9 )
{
v23 = *(_DWORD *)(v9 + 2512);
if( (v23 & 0x10000000) != 0 && (v23 & 0x20000000) == 0 )
v29.m128i_i64[1] = v29.m128i_i64[1] & 0xFFFFCFFFFFFFFFFFui64 | 0x100000000000i64;
}
if( (((unsigned __int64)v29.m128i_i64[1] >> 44) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x10000000u);
}
else if( (((unsigned __int64)v29.m128i_i64[1] >> 44) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2512), 0x30000000u);
}
switch( ((unsigned __int64)v29.m128i_i64[1] >> 60) & 3 )
{
case 0ui64:
if( (v33 & 0x40000) == 0 || (v33 & 0x800000) != 0 || (v33 & 0x1000000) != 0 )
break;
if( (v33 & 0x100000) != 0 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x100000u);
v29.m128i_i64[1] = v29.m128i_i64[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
LABEL_195:
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x4000u);
break;
case 1ui64:
goto LABEL_195;
case 3ui64:
v29.m128i_i64[1] = v29.m128i_i64[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x4000u);
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x100000u);
break;
}
if( ((*((_QWORD *)&v31 + 1) >> 60) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x8000u);
if( (*(_DWORD *)(v5 + 2516) & 0x4000) == 0 )
{
v24 = v30 & 0xFFFFFFFFFFFFFFFCui64 | 2;
goto LABEL_206;
}
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x20000u);
if( (v30 & 3) != 0 )
{
if( (v30 & 3) == 3 )
goto LABEL_204;
}
else if( (v33 & 0x200000) != 0 )
{
LABEL_204:
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x80000000);
}
v24 = v30 & 0xFFFFFFFFFFFFFFFCui64 | 1;
LABEL_206:
v30 = v24;
if( (v32 & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x40000u);
if( ((v30 >> 4) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x200000u);
}
else if( ((v30 >> 4) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x200000u);
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x400000u);
}
if( ((v32 >> 4) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x800000u);
if( ((v30 >> 16) & 3) == 0 )
{
if( (v33 & 0x400000) != 0 )
goto LABEL_219;
goto LABEL_218;
}
if( ((v30 >> 16) & 3) == 1 )
LABEL_218:
_InterlockedOr((volatile signed __int32 *)(v5 + 2516), 0x40000000u);
LABEL_219:
v25 = v30 >> 20;
if( (v25 & 3) == 1 )
PspSetRedirectionTrustPolicy(v5, 1);
if( (v25 & 3) != 1 && ((v32 >> 20) & 3) == 1 )
PspSetRedirectionTrustPolicy(v5, 2);
v26 = v30;
*v7 = v29;
v7[1].m128i_i64[0] = v26;
}Referenced by:
PspAllocateProcess