NtMapCMFModule
NTSTATUS __stdcall NtMapCMFModule(
UINT64 What,
UINT64 Index,
UINT64 *CacheIndexOut,
UINT64 *CacheFlagsOut,
UINT64 *ViewSizeOut,
VOID **BaseAddress){
UINT64 *v6;
UINT64 *v7;
unsigned int v8;
char v9;
NTSTATUS v10;
int v11;
INT64 v12;
int v13;
_ETHREAD *CurrentThread;
unsigned int v15;
unsigned int v16;
_DWORD *v17;
_ETHREAD *v18;
unsigned int v19;
unsigned int v20;
int v21;
unsigned int v22;
int v23;
bool v24;
VOID **v25;
VOID **PoolWithTag;
PADAPTER_OBJECT v27;
INT64 v28;
int v29;
NTSTATUS v30;
signed __int64 v31;
signed __int64 v32;
__int64 v33;
__int64 v34;
__int64 v35;
__int64 v36;
UINT64 AllocationType;
UINT64 Win32Protect;
NTSTATUS v40;
int v41;
VOID *MappedBase;
INT8 PreviousMode;
unsigned int v44;
UINT64 v45;
UINT64 ViewSize;
UINT64 DesiredAccess;
_LARGE_INTEGER SectionOffset;
VOID **v49;
unsigned int v50;
VOID *Handle;
__int128 v52;
__int128 v53;
__int128 v54;
__int64 v55;
__int128 Object;
__int64 v57;
__int128 v58;
__int128 v59;
__int128 v60;
_ETHREAD *v62;
int v63;
unsigned int v64;
v64 = Index;
v63 = What;
v6 = CacheFlagsOut;
v7 = CacheIndexOut;
v8 = Index;
v58 = 0i64;
v59 = 0i64;
v60 = 0i64;
SectionOffset.QuadPart = 0i64;
Object = 0i64;
v57 = 0i64;
Handle = 0i64;
v52 = 0i64;
v53 = 0i64;
v54 = 0i64;
v55 = 0i64;
MappedBase = 0i64;
ViewSize = 0i64;
v41 = 0;
v44 = 0;
v9 = KeGetCurrentThread()->PreviousMode;
PreviousMode = v9;
if( !v9 || InitSafeBootMode )
{
v10 = -1073741823;
LABEL_3:
v40 = v10;
goto LABEL_118;
}
v11 = What;
if( (What & 0xFFE0FE81) != 0 )
{
LABEL_6:
v10 = -1073741811;
goto LABEL_3;
}
v10 = MUIInitializeResourceLock(&CMFLock);
v40 = v10;
if( (v10 & 0xC0000000) == -1073741824 )
goto LABEL_118;
if( (v11 & 0x20000) != 0 )
{
v12 = v11 & 0x180000;
if( (v11 & 0x180000) != 0 && (v11 & 0x40000) != 0 || (_DWORD)v12 == 1572864 )
goto LABEL_6;
v13 = v11 & 0x1C0000;
if( v13 == (CMFFlagsCache & 0x1C0000) )
{
LABEL_12:
v10 = 0;
goto LABEL_3;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)CMFLock, 1, v12);
if( v13 != (CMFFlagsCache & 0x1C0000) )
{
if( CMFDirectorySectionPointer )
{
if( !v13 )
{
v40 = -1073741637;
LABEL_31:
ExReleaseResourceLite(CMFLock);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v10 = v40;
goto LABEL_118;
}
if( CMFDirectorySectionPointer )
{
v15 = 0x80000000;
v50 = 0x80000000;
if( (CMFFlagsCache & 0x1C0000) != 0 )
v15 = -1073741824;
v50 = v15;
v40 = CMFCheckAccess(CMFDirectorySectionPointer, v15, v9);
if( (v40 & 0xC0000000) == -1073741824 )
goto LABEL_31;
}
}
v16 = v13 | CMFFlagsCache & 0xFFE3FFFF;
CMFFlagsCache = v16;
if( CMFDirectorySectionPointer && ((v16 & 0x80000) != 0 || (v16 & 0x100000) != 0) )
{
MappedBase = 0i64;
ViewSize = 104i64;
SectionOffset.QuadPart = 0i64;
if( MmMapViewInSystemSpace(CMFDirectorySectionPointer, &MappedBase, &ViewSize) >= 0 )
{
v17 = MappedBase;
if( MappedBase )
{
if( ViewSize >= 0x68 )
{
*((_DWORD *)MappedBase + 12) &= 0xFFE3FFFF;
v17[12] |= (CMFFlagsCache & 0x80000) != 0 ? 0x80000 : 0x100000;
v17 = MappedBase;
}
MmUnmapViewInSystemSpace(v17);
MappedBase = 0i64;
}
}
CMFUnmapModules((CMFFlagsCache & 0x100000) != 0 ? 304 : 32);
CMFRegisterEventTime(4u);
}
}
v40 = 0;
goto LABEL_31;
}
v18 = (_ETHREAD *)KeGetCurrentThread();
--v18->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)CMFLock, 1);
if( !CMFFlagsCache )
{
v19 = v63 | 1;
LABEL_49:
v20 = v19 & 0xFFFFFECF;
v44 = v20;
v21 = v19 & 0x130;
LODWORD(v45) = (v20 & 0x40) != 0 ? 4 : 2;
v22 = (v20 & 0x40) != 0 ? -1073741824 : 0x80000000;
LODWORD(DesiredAccess) = v22;
v41 = 10000;
switch( v21 )
{
case 16:
if( (unsigned int)CMFCacheIndex < 0x2710 )
{
v41 = CMFCacheIndex;
LABEL_58:
v24 = (v20 & 2) != 0;
v25 = (VOID **)&CMFDirectorySectionPointer;
LABEL_69:
v49 = v25;
v27 = (PADAPTER_OBJECT)*v25;
goto LABEL_73;
}
if( v8 < 0x2710 )
{
v41 = v8;
goto LABEL_58;
}
if( CMFFirstAccess )
{
CMFRegisterEventTime(1u);
CMFFirstAccess = 0;
}
break;
case 32:
if( v8 < 0x1E && CMFCacheIndex != 10000 )
{
v41 = CMFCacheIndex;
if( !CMFSegmentSectionPointer )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xF0ui64, 1668114000i64);
MappedBase = PoolWithTag;
if( !PoolWithTag )
{
v40 = -1073741801;
goto LABEL_98;
}
memset(PoolWithTag, 0i64, 0xF0u);
if( _InterlockedCompareExchange64(
(volatile signed __int64 *)&CMFSegmentSectionPointer,
(signed __int64)MappedBase,
0i64) )
{
ExFreePoolWithTag(MappedBase, 0);
}
MappedBase = 0i64;
v20 = v44;
}
v24 = (v20 & 4) != 0;
v25 = (VOID **)((char *)CMFSegmentSectionPointer + 8 * v8);
goto LABEL_69;
}
break;
case 256:
v41 = CMFCacheIndex;
v25 = (VOID **)&CMFHitsSectionPointer;
v49 = (VOID **)&CMFHitsSectionPointer;
if( CMFHitsSectionPointer )
goto LABEL_87;
CMFHitsLastFlushTime = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
v27 = CMFHitsSectionPointer;
v24 = (v20 & 8) != 0;
v20 = v44;
v25 = v49;
LABEL_73:
if( !v27 )
{
ExReleaseResourceLite(CMFLock);
ExAcquireResourceExclusiveLite((UINT64)CMFLock, 1, v28);
if( ((v20 ^ CMFFlagsCache) & 0x1C0000) != 0 && (CMFFlagsCache & 0x180000) != 0 )
{
v23 = -1073741823;
goto LABEL_56;
}
v22 = DesiredAccess;
if( *v25 )
{
v29 = v45;
}
else
{
LODWORD(v52) = 0x8000000;
*(_QWORD *)((char *)&v52 + 4) = __PAIR64__(DesiredAccess, v41);
BYTE12(v52) = v24;
*((_QWORD *)&v53 + 1) = __PAIR64__(v64, v20);
v29 = v45;
LODWORD(v54) = v45;
*((_QWORD *)&v54 + 1) = v25;
LODWORD(v55) = v21;
KeInitializeEvent((INT64)&Object, 1, 0);
*(_QWORD *)&v53 = &Object;
LODWORD(v58) = 48;
*((_QWORD *)&v58 + 1) = 0i64;
DWORD2(v59) = 512;
*(_QWORD *)&v59 = 0i64;
v60 = 0i64;
v40 = PsCreateSystemThreadEx(
(__int64)&Handle,
0x1FFFFF,
&v58,
0i64,
0i64,
CMFSystemThreadRoutine,
(INT64)&v52,
0i64,
0i64);
if( (v40 & 0xC0000000) == -1073741824 )
goto LABEL_98;
ZwClose((_HANDLE)Handle);
v30 = KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
v40 = v30;
if( v30 )
{
if( v30 >= 0 )
v40 = -1073741823;
goto LABEL_98;
}
v44 = DWORD2(v53);
v40 = DWORD1(v54);
if( (DWORD1(v54) & 0xC0000000) == -1073741824 )
{
LABEL_98:
v7 = CacheIndexOut;
goto LABEL_99;
}
if( v21 == 16 )
CMFRegisterEventTime(2u);
}
ExConvertExclusiveToSharedLite(CMFLock);
LABEL_88:
MappedBase = 0i64;
ViewSize = 0i64;
SectionOffset.QuadPart = 0i64;
if( BaseAddress )
{
if( v21 == 256 || (v40 = CMFCheckAccess(*v25, v22, PreviousMode), (v40 & 0xC0000000) != -1073741824) )
{
v62 = (_ETHREAD *)KeGetCurrentThread();
LODWORD(Win32Protect) = v29;
LODWORD(AllocationType) = 0x400000;
v40 = MmMapViewOfSection(
*v49,
v62->Tcb.ApcState.Process,
&MappedBase,
0i64,
0i64,
&SectionOffset,
&ViewSize,
ViewShare,
AllocationType,
Win32Protect);
if( (v40 & 0xC0000000) == -1073741824 )
{
MappedBase = 0i64;
}
else if( v21 == 256 )
{
v31 = CMFHitsLastFlushTime;
v32 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
if( *(__int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart > CMFHitsLastFlushTime + 36000000000i64
&& v31 == _InterlockedCompareExchange64(
&CMFHitsLastFlushTime,
*(signed __int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart,
CMFHitsLastFlushTime)
&& CMFFlushHitsFile(MappedBase, ViewSize) < 0 )
{
_InterlockedCompareExchange64(&CMFHitsLastFlushTime, v31, v32);
}
}
}
}
goto LABEL_98;
}
LABEL_87:
v29 = v45;
goto LABEL_88;
}
v23 = -1073741811;
LABEL_56:
v40 = v23;
goto LABEL_98;
}
if( (CMFFlagsCache & 0xF) != 0 )
v19 = CMFFlagsCache & 0xF | v63 & 0xFFFFFFF0;
else
v19 = v63 | 1;
if( (CMFFlagsCache & 0x100000) != 0 )
{
if( (v19 & 0x10000) == 0 )
{
v40 = -1073741672;
goto LABEL_100;
}
v19 |= 0x100000u;
goto LABEL_47;
}
if( (CMFFlagsCache & 0x80000) == 0 )
{
if( (CMFFlagsCache & 0x40000) != 0 )
v19 |= 0x40000u;
goto LABEL_47;
}
if( (v19 & 0x130) != 32 || (v19 & 0x10000) != 0 )
{
v19 |= 0x80000u;
LABEL_47:
v8 = v64;
goto LABEL_49;
}
v40 = -1073741672;
LABEL_99:
v6 = CacheFlagsOut;
LABEL_100:
ExReleaseResourceLite(CMFLock);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v10 = v40;
if( (v40 & 0xC0000000) != -1073741824 )
{
v33 = 0x7FFFFFFF0000i64;
if( BaseAddress )
{
v34 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)BaseAddress < 0x7FFFFFFF0000i64 )
v34 = (__int64)BaseAddress;
*(_QWORD *)v34 = *(_QWORD *)v34;
*BaseAddress = MappedBase;
MappedBase = 0i64;
}
if( ViewSizeOut )
{
v35 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)ViewSizeOut < 0x7FFFFFFF0000i64 )
v35 = (__int64)ViewSizeOut;
*(_DWORD *)v35 = *(_DWORD *)v35;
*(_DWORD *)ViewSizeOut = ViewSize;
}
if( v7 )
{
v36 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)v7 < 0x7FFFFFFF0000i64 )
v36 = (__int64)v7;
*(_DWORD *)v36 = *(_DWORD *)v36;
*(_DWORD *)v7 = v41;
}
if( v6 )
{
if( (unsigned __int64)v6 < 0x7FFFFFFF0000i64 )
v33 = (__int64)v6;
*(_DWORD *)v33 = *(_DWORD *)v33;
*(_DWORD *)v6 = v44;
}
goto LABEL_12;
}
LABEL_118:
if( MappedBase )
{
MiUnmapViewOfSection(KeGetCurrentThread()->ApcState.Process, MappedBase, 0i64);
return v40;
}
return v10;
}Referenced by:
No references.