NtAlpcOpenSenderProcess

INT64 __fastcall NtAlpcOpenSenderProcess(
        VOID **ProcessHandle,
        VOID *PortHandle,
        _PORT_MESSAGE *PortMessage,
        UINT64 Flags,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes){
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  KPROCESSOR_MODE v10; 
  int v11; 
  _OBJECT_ATTRIBUTES *v12; 
  __int64 v13; 
  struct _DMA_ADAPTER *v14; 
  ULONG_PTR v15; 
  __int64 v16; 
  _QWORD *v17; 
  __int64 v19; 
  INT64 *v20; 
  struct _DMA_ADAPTER *v21; 
  PVOID Object; 
  ULONG_PTR BugCheckParameter2; 
  PVOID ProcessHandlea; 
  __int128 Source2; 
  INT64 v26[2]; 
  INT64 v27; 
  OBJECT_ATTRIBUTES v28; 
  v6 = Flags;
  Source2 = 0i64;
  *(_OWORD *)v26 = 0i64;
  v27 = 0i64;
  ProcessHandlea = 0i64;
  BugCheckParameter2 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  Object = 0i64;
  v11 = ObReferenceObjectByHandle(PortHandle, 0x20000u, AlpcPortObjectType, v10, &Object, 0i64);
  if( v11 < 0 )
    goto LABEL_15;
  if( v10 )
  {
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)ProcessHandle < 0x7FFFFFFF0000i64 )
      v13 = (__int64)ProcessHandle;
    *(_QWORD *)v13 = *(_QWORD *)v13;
    AlpcpProbeAndCaptureMessageHeader(PortMessage, (_PORT_MESSAGE *)&Source2, v6);
    if( ObjectAttributes < v12 )
      v12 = ObjectAttributes;
    v28 = *v12;
  }
  else
  {
    Source2 = *(_OWORD *)PortMessage;
    *(_OWORD *)v26 = *((_OWORD *)PortMessage + 1);
    v27 = *((_QWORD *)PortMessage + 4);
    v28 = *ObjectAttributes;
  }
  v14 = (struct _DMA_ADAPTER *)Object;
  v11 = AlpcpLookupMessage((INT64)Object, LODWORD(v26[1]), (unsigned int)v27, (INT64)v12, &BugCheckParameter2);
  if( v11 < 0 )
  {
    HalPutDmaAdapter(v14);
    goto LABEL_15;
  }
  v15 = BugCheckParameter2;
  if( (*(_DWORD *)(BugCheckParameter2 + 40) & 0x80u) != 0 )
  {
    AlpcpUnlockMessage(BugCheckParameter2);
    HalPutDmaAdapter(v14);
    v11 = -1073740029;
    goto LABEL_15;
  }
  v16 = *(_QWORD *)(BugCheckParameter2 + 32);
  if( v16 )
  {
    if( RtlCompareMemory((VOID *)(v16 + 1144), (char *)&Source2 + 8, 0x10ui64) != 16 )
    {
      AlpcpUnlockMessage(v15);
      HalPutDmaAdapter(v14);
      v11 = -1073741813;
      goto LABEL_15;
    }
    v17 = *(_QWORD **)(v16 + 544);
    ObfReferenceObjectWithTag(v17, 0x63706C41u);
    goto LABEL_13;
  }
  v19 = *(_QWORD *)(BugCheckParameter2 + 24);
  if( !v19 )
  {
    AlpcpUnlockMessage(BugCheckParameter2);
    v21 = v14;
    goto LABEL_28;
  }
  v20 = (INT64 *)(v19 + 352);
  ExAcquirePushLockSharedEx(v19 + 352, 0i64);
  if( (*(_DWORD *)(v19 + 416) & 0x40) == 0 )
  {
    v17 = *(_QWORD **)(v19 + 24);
    if( v17[136] == *((_QWORD *)&Source2 + 1) )
    {
      ObfReferenceObjectWithTag(v17, 0x63706C41u);
      if( _InterlockedCompareExchange64(v20, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v20);
      KeAbPostRelease(v20);
      v15 = BugCheckParameter2;
      v14 = (struct _DMA_ADAPTER *)Object;
LABEL_13:
      AlpcpUnlockMessage(v15);
      v11 = PsOpenProcess(
              &ProcessHandlea,
              (unsigned int)DesiredAccess,
              &v28,
              (CLIENT_ID *)((char *)&Source2 + 8),
              0,
              v10);
      ObfDereferenceObjectWithTag(v17, 0x63706C41ui64);
      HalPutDmaAdapter(v14);
      if( v11 >= 0 )
        *ProcessHandle = ProcessHandlea;
      goto LABEL_15;
    }
    if( _InterlockedCompareExchange64(v20, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v20);
    KeAbPostRelease(v20);
    AlpcpUnlockMessage(BugCheckParameter2);
    v21 = (struct _DMA_ADAPTER *)Object;
LABEL_28:
    HalPutDmaAdapter(v21);
    v11 = -1073741790;
    goto LABEL_15;
  }
  if( _InterlockedCompareExchange64(v20, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)(v19 + 352));
  KeAbPostRelease((PVOID)(v19 + 352));
  AlpcpUnlockMessage(BugCheckParameter2);
  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  v11 = -1073741769;
LABEL_15:
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v11;
}

Referenced by: