PspCopyAndFixupParameters

NTSTATUS __stdcall PspCopyAndFixupParameters(
        VOID *ParentProcess,
        VOID **DuplicateHandleList,
        PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  unsigned int *v4; 
  __int64 v5; 
  _RTL_USER_PROCESS_PARAMETERS *v6; 
  _EPROCESS *Process; 
  char PreviousMode; 
  NTSTATUS v9; 
  signed __int64 v10; 
  wchar_t *Buffer; 
  wchar_t *v12; 
  wchar_t *v13; 
  wchar_t *v14; 
  wchar_t *v15; 
  wchar_t *v16; 
  wchar_t *v17; 
  wchar_t *v18; 
  wchar_t *v19; 
  wchar_t *v20; 
  unsigned __int64 *DefaultThreadpoolCpuSetMasks; 
  char *Environment; 
  NTSTATUS result; 
  UINT64 *v24; 
  unsigned int v25; 
  VOID **v26; 
  UINT64 v27; 
  UINT64 v28; 
  INT64 v29; 
  INT64 v30; 
  INT64 v31; 
  int v32; 
  VOID *v33; 
  char v34; 
  UINT64 v35; 
  _EPROCESS *v36; 

  v33 = ParentProcess;
  v35 = 0i64;
  v4 = (unsigned int *)*((_QWORD *)CreateContext + 26);
  v5 = *((_QWORD *)v4 + 126) + *v4;
  v32 = v5;
  v6 = (_RTL_USER_PROCESS_PARAMETERS *)*((_QWORD *)CreateContext + 27);
  Process = KeGetCurrentThread()->ApcState.Process;
  v36 = Process;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v34 = PreviousMode;
  if( (CreateContext[2] & 0x40) != 0 && (*((_BYTE *)CreateContext + 9) & 1) == 0 )
    v4[2] |= 0x4000u;
  if( CreateContext[20] == 3 && (int)v4[4] > 0 )
  {
    LODWORD(v31) = 6;
    LODWORD(v30) = 0;
    LODWORD(v29) = 0;
    v9 = ObDuplicateObject((INT64)ParentProcess, *((_QWORD *)v4 + 2), (INT64)Process, &v35, v29, v30, v31, PreviousMode);
    ParentProcess = v33;
    Process = v36;
    PreviousMode = v34;
    if( v9 >= 0 )
      *((_QWORD *)v4 + 2) = v35;
  }
  if( DuplicateHandleList )
  {
    v24 = (UINT64 *)(v4 + 8);
    v25 = 0;
    v26 = DuplicateHandleList;
    while( 1 )
    {
      v27 = (UINT64)*v26;
      if( *v26 )
      {
        if( (v27 & 0x80000000) != 0i64 )
        {
          v28 = 0i64;
          v35 = 0i64;
          result = -1073741816;
        }
        else
        {
          LODWORD(v31) = 6;
          LODWORD(v30) = 0;
          LODWORD(v29) = 0;
          result = ObDuplicateObject((INT64)ParentProcess, v27, (INT64)Process, &v35, v29, v30, v31, PreviousMode);
          v28 = v35;
        }
        if( result < 0 )
        {
          if( DuplicateHandleList == (VOID **)(v4 + 8) )
            return result;
        }
        else
        {
          *v24 = v28;
        }
      }
      ++v24;
      ++v25;
      ++v26;
      if( v25 >= 3 )
        break;
      ParentProcess = v33;
      Process = v36;
      PreviousMode = v34;
    }
    LODWORD(v5) = v32;
  }
  v10 = (char *)v6 - (char *)v4;
  memmove(v6, v4, v5);
  Buffer = v6->CurrentDirectory.DosPath.Buffer;
  if( Buffer )
    v6->CurrentDirectory.DosPath.Buffer = (wchar_t *)((char *)Buffer + v10);
  v12 = v6->DllPath.Buffer;
  if( v12 )
    v6->DllPath.Buffer = (wchar_t *)((char *)v12 + v10);
  v13 = v6->ImagePathName.Buffer;
  if( v13 )
    v6->ImagePathName.Buffer = (wchar_t *)((char *)v13 + v10);
  v14 = v6->CommandLine.Buffer;
  if( v14 )
    v6->CommandLine.Buffer = (wchar_t *)((char *)v14 + v10);
  v15 = v6->WindowTitle.Buffer;
  if( v15 )
    v6->WindowTitle.Buffer = (wchar_t *)((char *)v15 + v10);
  v16 = v6->DesktopInfo.Buffer;
  if( v16 )
    v6->DesktopInfo.Buffer = (wchar_t *)((char *)v16 + v10);
  v17 = v6->ShellInfo.Buffer;
  if( v17 )
    v6->ShellInfo.Buffer = (wchar_t *)((char *)v17 + v10);
  v18 = v6->RuntimeData.Buffer;
  if( v18 )
    v6->RuntimeData.Buffer = (wchar_t *)((char *)v18 + v10);
  v19 = v6->RedirectionDllName.Buffer;
  if( v19 )
    v6->RedirectionDllName.Buffer = (wchar_t *)((char *)v19 + v10);
  v20 = v6->HeapPartitionName.Buffer;
  if( v20 )
    v6->HeapPartitionName.Buffer = (wchar_t *)((char *)v20 + v10);
  DefaultThreadpoolCpuSetMasks = v6->DefaultThreadpoolCpuSetMasks;
  if( DefaultThreadpoolCpuSetMasks )
    v6->DefaultThreadpoolCpuSetMasks = (unsigned __int64 *)((char *)DefaultThreadpoolCpuSetMasks + v10);
  Environment = (char *)v6->Environment;
  if( Environment )
    v6->Environment = &Environment[v10];
  KeGetCurrentThread()->ApcState.Process->Peb->ProcessParameters = v6;
  return 0;
}

Referenced by: