AlpcpConnectPort

INT64 __fastcall AlpcpConnectPort(
        VOID **PortHandle,
        _UNICODE_STRING *ConnectionPortName,
        _OBJECT_ATTRIBUTES *ConnectionPortObjectAttributes,
        _OBJECT_ATTRIBUTES *ClientPortObjectAttributes,
        _ALPC_PORT_ATTRIBUTES *PortAttributes,
        INT64 Flags,
        VOID *ServerSecurityRequirements,
        VOID *RequiredServerSid,
        _PORT_MESSAGE *ConnectionMessage,
        UINT64 *BufferLength,
        _ALPC_MESSAGE_ATTRIBUTES *OutMessageAttributes,
        _ALPC_MESSAGE_ATTRIBUTES *InMessageAttributes,
        _LARGE_INTEGER *Timeout){
  UINT8 v14; 
  PVOID *v15; 
  _ETHREAD *CurrentThread; 
  INT8 v17; 
  unsigned int v18; 
  __int64 v19; 
  _ALPC_PORT_ATTRIBUTES *v20; 
  UINT64 v21; 
  PADAPTER_OBJECT v22; 
  int v23; 
  INT64 ProbeMode; 
  CHAR CapturedServerSid; 
  int v27; 
  PADAPTER_OBJECT DmaAdapter[3]; 
  HANDLE Handle; 
  CHAR WaitMode[8]; 
  PVOID CapturedSecurityDescriptor; 
  _OBJECT_ATTRIBUTES *v32; 
  _OBJECT_ATTRIBUTES *ConnectionPortObjectAttributesa; 
  _UNICODE_STRING *ConnectionPortNamea; 
  _LARGE_INTEGER *v35; 
  _ALPC_MESSAGE_ATTRIBUTES *ReceiveMessageAttributes; 
  _ALPC_MESSAGE_ATTRIBUTES *SendMessageAttributes; 
  UINT64 *v38; 
  VOID **v39; 
  _ALPC_PORT_ATTRIBUTES result; 
  v32 = ClientPortObjectAttributes;
  ConnectionPortObjectAttributesa = ConnectionPortObjectAttributes;
  ConnectionPortNamea = ConnectionPortName;
  v39 = PortHandle;
  DmaAdapter[1] = (PADAPTER_OBJECT)ServerSecurityRequirements;
  DmaAdapter[2] = (PADAPTER_OBJECT)RequiredServerSid;
  v38 = BufferLength;
  SendMessageAttributes = OutMessageAttributes;
  ReceiveMessageAttributes = InMessageAttributes;
  v35 = Timeout;
  DmaAdapter[0] = 0i64;
  Handle = 0i64;
  memset((INT64)&result, 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v17 = *((_BYTE *)KeGetCurrentThread() + 562);
  v18 = Flags & 0xFFFF0000;
  *(_QWORD *)WaitMode = RequiredServerSid;
  CapturedSecurityDescriptor = ServerSecurityRequirements;
  if( !v17 )
  {
    if( PortAttributes )
      result = *PortAttributes;
    goto LABEL_15;
  }
  v19 = (__int64)PortHandle;
  if( (unsigned __int64)PortHandle >= 0x7FFFFFFF0000i64 )
    v19 = 0x7FFFFFFF0000i64;
  *(_QWORD *)v19 = *(_QWORD *)v19;
  if( PortAttributes )
  {
    v20 = PortAttributes;
    if( (unsigned __int64)PortAttributes >= 0x7FFFFFFF0000i64 )
      v20 = (_ALPC_PORT_ATTRIBUTES *)0x7FFFFFFF0000i64;
    result = *v20;
  }
  if( !RequiredServerSid || (v27 = SeCaptureSid(RequiredServerSid, v17, v14, v15), v27 >= 0) )
  {
    if( !ServerSecurityRequirements
      || (v27 = SeCaptureSecurityDescriptor(ServerSecurityRequirements, v17, PagedPool, 0, &CapturedSecurityDescriptor),
          v27 >= 0) )
    {
LABEL_15:
      v27 = AlpcpCreateClientPort(
              &Handle,
              (_ALPC_PORT **)DmaAdapter,
              v18,
              ConnectionPortNamea,
              ConnectionPortObjectAttributesa,
              v32,
              (_ALPC_PORT_ATTRIBUTES *)((unsigned __int64)&result & -(__int64)(PortAttributes != 0i64)),
              CapturedSecurityDescriptor,
              *(VOID **)WaitMode,
              0i64,
              0);
      if( v27 >= 0 )
      {
        LOBYTE(ProbeMode) = v17;
        v21 = v18;
        v22 = DmaAdapter[0];
        v23 = AlpcpProcessConnectionRequest(
                (_ALPC_PORT *)DmaAdapter[0],
                v21,
                ConnectionMessage,
                v38,
                SendMessageAttributes,
                ReceiveMessageAttributes,
                v35,
                ProbeMode,
                CapturedServerSid);
        v27 = v23;
        if( v23 == -1073741759 && (*(_DWORD *)&v22[26].Version & 0x100) != 0 )
          *PortHandle = v22[3].DmaOperations;
        if( !v23 )
          *PortHandle = Handle;
        HalPutDmaAdapter(v22);
        if( v23 )
          NtClose(Handle);
      }
    }
  }
  if( *(_QWORD *)WaitMode && *(VOID **)WaitMode != RequiredServerSid )
    SeReleaseSid(*(PVOID *)WaitMode, v17, 1u);
  if( CapturedSecurityDescriptor && CapturedSecurityDescriptor != ServerSecurityRequirements )
    SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, v17, 0);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v27;
}

Referenced by: