AlpcpExposeViewAttributeInSenderContext

INT64 __fastcall AlpcpExposeViewAttributeInSenderContext(INT64 a1, INT64 a2){
  ULONG_PTR v2; 
  unsigned int v5; 
  INT64 i; 
  _KALPC_VIEW *View; 
  _KALPC_VIEW *v8; 
  int v9; 
  __int64 v10; 
  int v11; 
  int v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  _KALPC_VIEW *ViewPointer; 
  _KAPC_STATE ApcState; 
  v2 = *(_QWORD *)(a2 + 144);
  memset(&ApcState, 0, sizeof(ApcState));
  v5 = 0;
  for( i = *(_QWORD *)(v2 + 16); ; AlpcpUnlockBlob((PVOID)i) )
  {
    AlpcpLockForCachedReferenceBlob((PVOID)i);
    View = (_KALPC_VIEW *)AlpcpLocateView(i, a1);
    ViewPointer = View;
    v8 = View;
    if( !View )
      break;
    LODWORD(v14) = AlpcpReferenceBlob(View);
    if( v14 > 0 )
      break;
  }
  if( (*(_DWORD *)(i + 48) & 1) != 0 )
  {
    if( v8 == *(_KALPC_VIEW **)(i + 80) )
    {
LABEL_12:
      *(_DWORD *)(a2 + 40) |= 0x4000u;
      *(_QWORD *)(a2 + 144) = v8;
      ++*((_DWORD *)v8 + 19);
      goto LABEL_13;
    }
    if( v8 && v8 == *(_KALPC_VIEW **)(i + 72) )
    {
      v15 = *(_DWORD *)(v2 + 72);
      if( (v15 & 8) == 0 )
      {
        LODWORD(v16) = MmSecureVirtualMemoryAgainstWrites(
                         *(_EPROCESS **)(v2 + 32),
                         *(PVOID *)(v2 + 40),
                         *(_QWORD *)(v2 + 48));
        if( !v16 )
        {
          if( *((_QWORD *)v8 + 8) )
          {
            KiStackAttachProcess(*((_KPROCESS **)v8 + 4), 0i64, &ApcState);
            MmUnsecureVirtualMemory(*((PVOID *)v8 + 8));
            KiUnstackDetachProcess(&ApcState, 0i64);
            *((_QWORD *)v8 + 8) = 0i64;
          }
          *((_DWORD *)v8 + 18) |= 1u;
          AlpcpDereferenceBlobEx(v8, 1i64);
          *(_QWORD *)(i + 72) = 0i64;
          *(_QWORD *)(i + 80) = 0i64;
          *(_DWORD *)(i + 48) &= ~1u;
          goto LABEL_12;
        }
        *(_QWORD *)(v2 + 64) = v16;
        v15 = *(_DWORD *)(v2 + 72);
      }
      *(_DWORD *)(v2 + 72) = v15 & 0xFFFFFFFE;
      AlpcpReferenceBlob((PVOID)v2);
      if( *((_QWORD *)v8 + 8) )
      {
        KiStackAttachProcess(*((_KPROCESS **)v8 + 4), 0i64, &ApcState);
        MmUnsecureVirtualMemory(*((PVOID *)v8 + 8));
        KiUnstackDetachProcess(&ApcState, 0i64);
        *((_QWORD *)v8 + 8) = 0i64;
      }
      *((_DWORD *)v8 + 18) |= 1u;
      *(_QWORD *)(i + 72) = v2;
      *(_QWORD *)(i + 80) = v8;
      AlpcpDereferenceBlobEx(v8, 1i64);
      goto LABEL_12;
    }
    v9 = *(_DWORD *)(v2 + 72);
    if( (v9 & 8) != 0 )
      goto LABEL_9;
    LODWORD(v10) = MmSecureVirtualMemoryAgainstWrites(
                     *(_EPROCESS **)(v2 + 32),
                     *(PVOID *)(v2 + 40),
                     *(_QWORD *)(v2 + 48));
    if( v10 )
    {
      *(_QWORD *)(v2 + 64) = v10;
      v9 = *(_DWORD *)(v2 + 72);
LABEL_9:
      *(_DWORD *)(v2 + 72) = v9 & 0xFFFFFFFE;
      AlpcpReferenceBlob((PVOID)v2);
      *(_QWORD *)(i + 80) = 0i64;
      *(_QWORD *)(i + 72) = v2;
      if( v8 )
      {
        *(_QWORD *)(i + 80) = v8;
        goto LABEL_12;
      }
      AlpcpCreateView((_KALPC_REGION *)i, (_ALPC_PORT *)a1, &ViewPointer);
      v5 = v11;
      if( v11 >= 0 )
        goto LABEL_11;
      AlpcpRestoreWriteAccess(v2);
      AlpcpDereferenceBlobEx((PVOID)v2, 1i64);
      goto LABEL_35;
    }
    *(_QWORD *)(i + 72) = 0i64;
    *(_QWORD *)(i + 80) = 0i64;
    *(_DWORD *)(i + 48) &= ~1u;
  }
  else if( v8 )
  {
    goto LABEL_12;
  }
  AlpcpCreateView((_KALPC_REGION *)i, (_ALPC_PORT *)a1, &ViewPointer);
  v5 = v13;
  if( v13 >= 0 )
  {
LABEL_11:
    v8 = ViewPointer;
    goto LABEL_12;
  }
LABEL_35:
  *(_QWORD *)(a2 + 144) = 0i64;
LABEL_13:
  --*(_DWORD *)(v2 + 76);
  if( (*(_DWORD *)(v2 + 72) & 2) != 0 )
  {
    AlpcpDeleteView(v2);
    *(_DWORD *)(v2 + 72) &= ~2u;
  }
  AlpcpUnlockBlob((PVOID)i);
  AlpcpDereferenceBlobEx((PVOID)v2, 1i64);
  return v5;
}

Referenced by: