EtwTimLogControlProtectionUserModeReturnMismatch
unsigned __int8 __fastcall EtwTimLogControlProtectionUserModeReturnMismatch(
int a1,
_EPROCESS *a2,
void *a3,
void *a4,
int a5){
_OBJECT_NAME_INFORMATION *ImageFileName;
const wchar_t *v6;
__int64 *v7;
unsigned int v9;
unsigned __int16 v11;
int v12;
const wchar_t *v13;
wchar_t *Buffer;
int Length;
__int16 v16;
unsigned int v17;
unsigned __int16 *Pool2;
unsigned __int16 *v19;
unsigned __int16 v20;
__int64 v21;
unsigned int v22;
const wchar_t *v23;
__int64 v24;
__int64 v25;
unsigned int v26;
unsigned __int16 *v27;
unsigned __int16 *v28;
unsigned __int16 v29;
__int64 v30;
__int64 v31;
__int64 v32;
const _EVENT_DESCRIPTOR *v33;
unsigned int v34;
int v35;
__int64 v36;
ULONG v37;
bool v38;
REGHANDLE v39;
unsigned __int8 result;
unsigned __int16 *v41;
unsigned __int16 *v42;
__int16 v43[2];
__int16 v44[2];
__int16 v45[2];
__int16 v46[2];
int v47;
int v48;
PVOID BaseAddress;
__int64 *v50;
__int64 *v51;
_UNICODE_STRING CommandLine;
_EVENT_DATA_DESCRIPTOR v53;
int *v54;
__int64 v55;
int *v56;
__int64 v57;
__int64 v58;
int v59[2];
int *v60;
__int64 v61;
wchar_t *v62;
int v63[2];
__int64 **v64;
__int64 v65;
int *v66;
__int64 v67;
__int64 v68;
int v69[2];
int *v70;
__int64 v71;
__int64 v72;
int v73[2];
int *v74;
__int64 v75;
PVOID *p_BaseAddress;
__int64 v77;
_EVENT_DATA_DESCRIPTOR UserData;
const wchar_t *v79;
int v80;
int v81;
__int16 *v82;
__int64 v83;
wchar_t *v84;
int v85;
int v86;
__int64 v87[22];
ImageFileName = a2->SeAuditProcessCreationInfo.ImageFileName;
v6 = L"(null)";
v48 = a1;
v51 = 0i64;
v7 = &EmptyUnicodeString;
BaseAddress = a4;
if( ImageFileName )
v7 = (__int64 *)ImageFileName;
v50 = v7;
v9 = 12;
v11 = *(_WORD *)v7;
*(_QWORD *)&UserData.Size = 2i64;
CommandLine = 0i64;
if( v11 )
{
v43[0] = v11 >> 1;
UserData.Ptr = (unsigned __int64)v43;
v12 = *(unsigned __int16 *)v7;
v13 = (const wchar_t *)v7[1];
}
else
{
v43[0] = 6;
UserData.Ptr = (unsigned __int64)v43;
v13 = L"(null)";
v12 = 12;
}
v79 = v13;
v80 = v12;
v81 = 0;
EtwpQueryProcessCommandLine(a2, &CommandLine);
Buffer = CommandLine.Buffer;
LOWORD(v47) = CommandLine.Length;
v83 = 2i64;
if( CommandLine.Length )
{
v84 = CommandLine.Buffer;
v82 = v46;
Length = CommandLine.Length;
v16 = CommandLine.Length >> 1;
}
else
{
v84 = L"(null)";
v82 = v46;
Length = 12;
v16 = 6;
}
v85 = Length;
v46[0] = v16;
v86 = 0;
v17 = EtwpTiFillProcessIdentity(v87, (__int64)a2, (unsigned __int64 *)&v51) + 4;
Pool2 = (unsigned __int16 *)ExAllocatePool2(256i64, 0x200ui64, 0x6E734954ui64);
v19 = Pool2;
if( Pool2
&& (ZwQueryVirtualMemory(-1, a3, MemoryMappedFilenameInformation, Pool2, 512, 0i64) >= 0 ? (v20 = *v19) : (*v19 = 0, v20 = 0),
v20) )
{
v44[0] = v20 >> 1;
v21 = 2i64 * v17;
*(&UserData.Ptr + v21) = (unsigned __int64)v44;
*((_QWORD *)&UserData.Size + v21) = 2i64;
v22 = *v19;
v23 = (const wchar_t *)*((_QWORD *)v19 + 1);
}
else
{
v44[0] = 6;
v23 = L"(null)";
v24 = 2i64 * v17;
*(&UserData.Ptr + v24) = (unsigned __int64)v44;
v22 = 12;
*((_QWORD *)&UserData.Size + v24) = 2i64;
}
v25 = 2i64 * (v17 + 1);
v26 = v17 + 2;
*(&UserData.Ptr + v25) = (unsigned __int64)v23;
*(&UserData.Size + 2 * v25) = v22;
*(&UserData.Reserved + 2 * v25) = 0;
v27 = (unsigned __int16 *)ExAllocatePool2(256i64, 0x200ui64, 0x6E734954ui64);
v28 = v27;
if( v27
&& (ZwQueryVirtualMemory(-1, BaseAddress, MemoryMappedFilenameInformation, v27, 512, 0i64) >= 0 ? (v29 = *v28) : (*v28 = 0, v29 = 0),
v29) )
{
v45[0] = v29 >> 1;
v30 = 2i64 * v26;
*(&UserData.Ptr + v30) = (unsigned __int64)v45;
*((_QWORD *)&UserData.Size + v30) = 2i64;
v9 = *v28;
v6 = (const wchar_t *)*((_QWORD *)v28 + 1);
}
else
{
v45[0] = 6;
v31 = 2i64 * v26;
*(&UserData.Ptr + v31) = (unsigned __int64)v45;
*((_QWORD *)&UserData.Size + v31) = 2i64;
}
v32 = 2i64 * (v26 + 1);
v33 = (const _EVENT_DESCRIPTOR *)MITIGATION_AUDIT_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH;
v34 = v26 + 2;
*(&UserData.Ptr + v32) = (unsigned __int64)v6;
*(&UserData.Size + 2 * v32) = v9;
*(&UserData.Reserved + 2 * v32) = 0;
v35 = v48;
v36 = 2i64 * v34;
v37 = v34 + 1;
v38 = v48 == 1;
*(&UserData.Ptr + v36) = (unsigned __int64)&a5;
v39 = *(&ExBootDevicesRemovedEvent + 248);
*((_QWORD *)&UserData.Size + v36) = 4i64;
if( !v38 )
v33 = &MITIGATION_ENFORCE_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH;
result = EtwWrite(v39, v33, 0, v37, &UserData);
if( *(&stru_140C00F40 + 1820) > 5u )
{
result = tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x400000000000i64);
if( result )
{
v54 = &v48;
v48 = v35;
v56 = v59;
v58 = v50[1];
v59[0] = *(unsigned __int16 *)v50;
v60 = v63;
v63[0] = (unsigned __int16)v47;
v50 = v51;
v64 = &v50;
v66 = v69;
v68 = *((_QWORD *)v41 + 1);
v69[0] = *v41;
v70 = v73;
v72 = *((_QWORD *)v42 + 1);
v73[0] = *v42;
v47 = a5;
v74 = &v47;
p_BaseAddress = &BaseAddress;
v55 = 4i64;
v57 = 2i64;
v59[1] = 0;
v61 = 2i64;
v62 = Buffer;
v63[1] = 0;
v65 = 8i64;
v67 = 2i64;
v69[1] = 0;
v71 = 2i64;
v73[1] = 0;
v75 = 4i64;
BaseAddress = (PVOID)0x1000000;
v77 = 8i64;
result = tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 7280,
(unsigned __int8 *)&dword_14002C34C,
0i64,
0i64,
0xEu,
&v53);
}
}
if( Buffer )
result = (unsigned __int8)ExFreePoolWithTag(Buffer, 0);
if( v19 )
result = (unsigned __int8)ExFreePoolWithTag(v19, 0);
if( v28 )
return(unsigned __int8)ExFreePoolWithTag(v28, 0);
return result;
}Referenced by:
KiLogControlProtectionUserModeReturnMismatch