ExpKdPullRemoteFileForUser
NTSTATUS __stdcall ExpKdPullRemoteFileForUser(_OWORD *a1){
char PreviousMode;
int v2;
VOID **PoolWithTag;
int v5;
_ETHREAD *CurrentThread;
_BYTE *v7;
int v8;
__int64 v9;
int v10;
int v11;
int v12;
NTSTATUS v13;
_ETHREAD *v14;
_BYTE *v15;
UINT64 v16;
UINT64 v17;
_BYTE *v18;
__int64 v19;
UINT64 v20;
UINT64 v21;
_DWORD *v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
NTSTATUS v29;
int v30;
__int64 v31;
int v32;
_UNICODE_STRING SourceString;
int v34;
VOID *Src[2];
_UNICODE_STRING DestinationString[2];
__int64 buf1[4];
SourceString = 0i64;
DestinationString[0] = 0i64;
*(_OWORD *)Src = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
*(_OWORD *)Src = *a1;
if( PreviousMode == 1 )
{
if( ((__int64)Src[1] & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Src[1] + 2 > 0x7FFFFFFF0000i64 || (char *)Src[1] + 2 < Src[1] )
MEMORY[0x7FFFFFFF0000] = 0;
}
v2 = 0;
if( !LOWORD(Src[0]) || ((__int64)Src[0] & 1) != 0 || (BYTE2(Src[0]) & 1) != 0 || WORD1(Src[0]) < LOWORD(Src[0]) )
return -1073741811;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, LOWORD(Src[0]), 1180978005i64);
SourceString.Buffer = (wchar_t *)PoolWithTag;
if( !PoolWithTag )
return -1073741670;
SourceString.Length = (unsigned __int16)Src[0];
SourceString.MaximumLength = (unsigned __int16)Src[0];
memmove(PoolWithTag, Src[1], LOWORD(Src[0]));
DestinationString[0].Buffer = (wchar_t *)ExAllocatePoolWithTag(0x200ui64, LOWORD(Src[0]), 1180978005i64);
if( !DestinationString[0].Buffer )
{
v5 = -1073741670;
goto LABEL_34;
}
DestinationString[0].Length = SourceString.Length;
DestinationString[0].MaximumLength = SourceString.MaximumLength;
RtlDowncaseUnicodeString(DestinationString, &SourceString, 0);
KeComputeSha256((UINT8 *)DestinationString[0].Buffer, DestinationString[0].Length, (UINT8 *)buf1);
ExFreePoolWithTag(DestinationString[0].Buffer, 0);
if( !*(&ExBootDevicesRemovedEvent + 19) )
goto LABEL_35;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v7 = KeAbPreAcquire((char *)&ExBootDevicesRemovedEvent + 160, 0i64, 0i64);
if( _InterlockedCompareExchange64((_QWORD *)&ExBootDevicesRemovedEvent + 20, 17i64, 0i64) )
ExfAcquirePushLockSharedEx(
(_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 20,
v7,
(char *)&ExBootDevicesRemovedEvent + 160);
if( v7 )
v7[26] |= 1u;
v8 = 0;
v9 = *(&ExBootDevicesRemovedEvent + 19);
if( !*(&ExBootDevicesRemovedEvent + 19) )
goto LABEL_30;
v10 = 0;
v11 = **(&ExBootDevicesRemovedEvent + 19) - 1;
if( v11 < 0 )
goto LABEL_30;
while( 1 )
{
v12 = (v10 + v11) >> 1;
v13 = memcmp(buf1, (const VOID *)(v9 + 8 * (v12 + 1i64)), 8ui64);
if( v13 < 0 )
{
if( !v12 )
goto LABEL_30;
v11 = v12 - 1;
goto LABEL_27;
}
if( v13 <= 0 )
break;
v10 = v12 + 1;
LABEL_27:
if( v11 < v10 )
goto LABEL_30;
}
v8 = 1;
LABEL_30:
v2 = 0;
if( _InterlockedCompareExchange64((_QWORD *)&ExBootDevicesRemovedEvent + 20, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 20);
KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 160);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( v8 )
{
v5 = 255;
goto LABEL_34;
}
LABEL_35:
v14 = (_ETHREAD *)KeGetCurrentThread();
--v14->Tcb.KernelApcDisable;
v15 = KeAbPreAcquire((char *)&ExBootDevicesRemovedEvent + 160, 0i64, 0i64);
v18 = v15;
if( _interlockedbittestandset64((volatile signed __int32 *)&ExBootDevicesRemovedEvent + 40, 0i64) )
ExfAcquirePushLockExclusiveEx(
(_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 20,
v15,
(char *)&ExBootDevicesRemovedEvent + 160);
if( v18 )
v18[26] |= 1u;
v19 = -1i64;
if( !*(&ExBootDevicesRemovedEvent + 19) )
{
v20 = 16400i64;
goto LABEL_44;
}
if( (int)**(&ExBootDevicesRemovedEvent + 19) >= 0x1FFFFFFF )
goto LABEL_76;
v21 = *(int *)(*(&ExBootDevicesRemovedEvent + 19) + 4i64);
if( **(&ExBootDevicesRemovedEvent + 19) == (_DWORD)v21 )
{
v20 = 16 * (v21 + 1);
LABEL_44:
v19 = (__int64)ExAllocatePoolWithTag(1ui64, v20, 1717848917i64);
}
if( !v19 )
{
LABEL_76:
v5 = -1073741670;
goto LABEL_77;
}
if( v19 == -1 )
{
v19 = *(&ExBootDevicesRemovedEvent + 19);
}
else
{
*(_DWORD *)v19 = 0;
*(_DWORD *)(v19 + 4) = 2048;
v22 = (_DWORD *)*(&ExBootDevicesRemovedEvent + 19);
if( *(&ExBootDevicesRemovedEvent + 19) )
{
memmove((VOID *)v19, *(&ExBootDevicesRemovedEvent + 19), 8 * **(&ExBootDevicesRemovedEvent + 19) + 16);
*(_DWORD *)(v19 + 4) = 2 * v22[1];
ExFreePoolWithTag(v22, 0);
}
*(&ExBootDevicesRemovedEvent + 19) = v19;
}
v23 = 0;
v24 = *(_DWORD *)v19;
v32 = v24;
v25 = *(_DWORD *)v19 - 1;
v34 = v25;
v26 = v24 - 1;
v27 = 0;
if( v25 < 0 )
goto LABEL_61;
while( 2 )
{
v28 = (v23 + v26) >> 1;
v29 = memcmp(buf1, (const VOID *)(v19 + 8 * (v28 + 1i64)), 8ui64);
if( v29 < 0 )
{
if( !v28 )
goto LABEL_60;
v26 = v28 - 1;
LABEL_57:
if( v26 < v23 )
goto LABEL_60;
continue;
}
break;
}
if( v29 > 0 )
{
v23 = v28 + 1;
goto LABEL_57;
}
v27 = 1;
LABEL_60:
v24 = v32;
v25 = v34;
v2 = 0;
LABEL_61:
if( v27 )
{
v5 = 255;
}
else
{
if( v26 < v23 )
{
v23 = 0;
v26 = v25;
if( !v24 )
{
*(_QWORD *)(v19 + 8) = buf1[0];
++*(_DWORD *)v19;
v19 = 0i64;
}
}
if( v19 )
{
if( v23 >= 0 )
v2 = v23;
v30 = v26 + 1;
while( v2 < v30 && memcmp(buf1, (const VOID *)(v19 + 8 * (v2 + 1i64)), 8ui64) >= 0 )
++v2;
v31 = v19 + 8i64 * v2;
memmove((VOID *)(v19 + 8 * (v2 + 1 + 1i64)), (const VOID *)(v31 + 8), 8 * (*(_DWORD *)v19 - v2));
++*(_DWORD *)v19;
*(_QWORD *)(v31 + 8) = buf1[0];
}
v5 = KdPullRemoteFile(&SourceString, v21, v16, v17);
if( v5 >= 0 )
DbgPrintEx(0x66u, 2u, "ExpKdPullRemoteFileForUser: Pulled %wZ from kd\n", &SourceString);
}
LABEL_77:
if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 20, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 20);
KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 160);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
LABEL_34:
ExFreePoolWithTag(SourceString.Buffer, 0);
return v5;
}Referenced by:
NtSystemDebugControl