PspBuildCreateProcessContext
INT64 __fastcall PspBuildCreateProcessContext(UINT64 *a1, CHAR a2, INT64 a3, INT64 a4){
CHAR v4;
INT64 v6;
UINT64 v7;
unsigned __int64 v9;
__int64 v10;
UINT64 *v11;
unsigned __int64 v12;
unsigned __int64 v13;
int v14;
int v15;
unsigned __int64 v16;
unsigned __int64 v17;
unsigned __int64 v18;
unsigned __int64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
__int64 v22;
_BYTE *v23;
UINT64 v24;
UINT8 *v25;
UINT8 *v26;
UINT64 v27;
UINT8 *v28;
UINT8 *v29;
unsigned __int64 v30;
unsigned __int64 v31;
unsigned __int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
unsigned __int64 v35;
__int64 v36;
int v37;
unsigned __int64 v38;
unsigned __int64 v39;
unsigned __int64 v40;
unsigned __int64 v41;
unsigned __int64 v42;
__int64 v43;
UINT64 v44;
unsigned __int64 v45;
VOID *v46;
unsigned __int64 v47;
unsigned __int64 i;
UINT64 v49;
UINT8 *v50;
UINT8 *v51;
UINT64 v52;
unsigned __int64 v53;
__int128 v54;
__int64 v55;
__int64 v56;
UINT64 v57;
UINT8 *v58;
UINT8 *v59;
__int64 v60;
unsigned __int64 v61;
unsigned __int64 v62;
unsigned __int64 v63;
unsigned __int64 v64;
unsigned __int64 v65;
unsigned __int64 v66;
__int64 v67;
char valid;
bool v69;
unsigned __int64 v70;
UINT64 v71;
unsigned __int64 v72;
__int128 v73;
__int64 v74;
__int64 v75;
UINT64 v76;
__int64 v77;
_OWORD *v78;
UINT8 **v79;
__int64 v80;
UINT8 *v81;
UINT8 *v82;
UINT8 *v83;
unsigned __int16 v84;
__int64 v85;
CHAR v86;
__int64 v87;
UINT8 *v88;
__int64 v89;
unsigned __int64 v90;
UINT8 *v91;
__int64 v92;
UINT8 *v93;
UINT8 *v94;
unsigned __int64 v95;
_QWORD *PoolWithQuotaTag;
_DWORD *v97;
__int64 v98;
int ProcessorIndexFromNumber;
unsigned __int64 v100;
unsigned __int64 v101;
unsigned __int64 v102;
unsigned __int64 v103;
unsigned __int64 v104;
UINT8 v105;
__int64 v106;
__int64 UmsContextExtendedSize;
unsigned __int64 v108;
unsigned __int64 v109;
__int64 v110;
UINT64 *v111;
unsigned __int16 v112;
unsigned __int64 v113;
unsigned __int64 v114;
unsigned __int64 v115;
struct _PROCESSOR_NUMBER ProcNumber;
UINT64 v117;
int v118;
int v119;
UINT8 *v120;
INT64 v121;
INT64 v122;
INT64 v123;
__int64 v124;
_BYTE *v125;
unsigned __int64 v126;
unsigned __int64 v127;
unsigned __int64 v128;
__int64 v129;
__int64 v130;
__int64 v131;
unsigned __int64 v132;
__int64 v133;
UINT8 *v134;
__int64 v135;
__int64 v136;
__int64 v137;
__int64 v138;
INT64 v139;
__int64 v140;
__int64 v141;
UINT8 *v142;
UINT8 *v143;
UINT8 *v144;
UINT8 *v145;
unsigned __int64 v146;
int v147;
UINT8 *v148;
UINT8 *v149;
UINT8 *v150;
UINT8 *v151;
unsigned __int64 v152;
UINT64 v153;
UINT64 MitigationOptions[2];
__int64 v155;
INT64 v156[2];
__int64 v157;
UINT8 dst[16];
__int64 v159;
UINT8 v160[16];
__int64 v161;
int v163;
v163 = a3;
v139 = a4;
v4 = a2;
v119 = a3;
v123 = a4;
v6 = a4;
v121 = a4;
v144 = 0i64;
v127 = 0i64;
v124 = 0i64;
*(_OWORD *)v160 = 0i64;
v161 = 0i64;
*(_OWORD *)dst = 0i64;
v159 = 0i64;
v143 = 0i64;
v136 = 0i64;
v134 = 0i64;
ProcNumber = 0;
v140 = 0i64;
v128 = 0i64;
v132 = 0i64;
v131 = 0i64;
v133 = 0i64;
v125 = 0i64;
v142 = 0i64;
v129 = 0i64;
v118 = 0;
v126 = 0i64;
v130 = 0i64;
v135 = 0i64;
v152 = 0i64;
v146 = 0i64;
v151 = 0i64;
v138 = 0i64;
v120 = 0i64;
v148 = 0i64;
v149 = 0i64;
v122 = 0i64;
v137 = 0i64;
v141 = 0i64;
v145 = 0i64;
*(_BYTE *)a4 = a2;
if( a2 && ((unsigned __int8)a1 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v7 = *a1;
v117 = v7;
if( v7 < 0x28 )
return 3221225485i64;
if( v4 && v7 != 40 )
{
if( ((unsigned __int8)a1 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)a1 + v7 > 0x7FFFFFFF0000i64 || (UINT64 *)((char *)a1 + v7) < a1 + 5 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v9 = v7 - 8;
v117 = v9;
if( (v9 & 0x1F) != 0 )
return 3221225485i64;
v10 = v9 >> 5;
v117 = v10;
v11 = a1 + 1;
v111 = a1 + 1;
v12 = 0x7FFFFFFF8i64;
while( v10 )
{
v13 = *v11;
v153 = *v11;
if( (_DWORD)a3 && (v13 & 0x10000) == 0 )
goto LABEL_17;
if( (v13 & 0x20000) != 0 && v11[3] )
goto LABEL_17;
v147 = 1 << v13;
v15 = *(_DWORD *)(a4 + 4);
if( ((1 << v13) & v15) != 0 )
goto LABEL_17;
*(_DWORD *)(a4 + 4) = v15 | (1 << v13);
if( v13 > 0x20015 )
{
if( v13 > 0x3000E )
{
v100 = v13 - 196623;
if( !v100 )
{
if( !(_DWORD)a3 || !v4 || v11[1] != 24 )
goto LABEL_17;
v141 = v11[2];
if( (v141 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v106 = v141;
*(_OWORD *)(a4 + 336) = *(_OWORD *)v141;
*(_QWORD *)(a4 + 352) = *(_QWORD *)(v106 + 16);
if( *(_DWORD *)(a4 + 336) != 256 )
{
LABEL_17:
v14 = -1073741811;
goto LABEL_305;
}
UmsContextExtendedSize = (unsigned int)RtlGetUmsContextExtendedSize();
v109 = *(_QWORD *)(a4 + 344);
if( (unsigned __int64)(UmsContextExtendedSize - 1) > 0xFFFE )
{
if( UmsContextExtendedSize )
{
if( (v109 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v109 + UmsContextExtendedSize > v108 || v109 + UmsContextExtendedSize < v109 )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else if( (v109 & 3) != 0 )
{
ExRaiseDatatypeMisalignment();
}
v110 = *(_QWORD *)(a4 + 352);
if( (v110 & 3) != 0 )
ExRaiseDatatypeMisalignment();
goto LABEL_158;
}
v101 = v100 - 196593;
if( v101 )
{
v102 = v101 - 1;
if( v102 )
{
v103 = v102 - 1;
if( v103 )
{
v104 = v103 - 15;
if( !v104 )
{
if( v11[1] != 1 )
goto LABEL_17;
v105 = *((_BYTE *)v11 + 16);
*(_BYTE *)(a4 + 384) = v105;
valid = RtlValidProcessProtection(v105);
goto LABEL_189;
}
if( v104 != 9 || v11[1] != 1 )
goto LABEL_17;
*(_BYTE *)(a4 + 9) = *(_BYTE *)(a4 + 9) & 0x7F | (v11[2] != 0 ? 0x80 : 0);
}
else
{
if( v11[1] != 8 )
goto LABEL_17;
*(_QWORD *)(a4 + 144) = v11[2];
}
}
else
{
if( v11[1] != 8 )
goto LABEL_17;
*(_QWORD *)(a4 + 136) = v11[2];
}
}
else
{
if( v11[1] != 8 )
goto LABEL_17;
*(_QWORD *)(a4 + 120) = v11[2];
}
}
else
{
if( v13 == 196622 )
{
if( !(_DWORD)a3 || v11[1] != 4 )
goto LABEL_17;
v98 = v11[2];
v140 = v98;
if( v4 )
{
if( (v98 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v98 = v140;
}
ProcNumber = *(struct _PROCESSOR_NUMBER *)v98;
ProcessorIndexFromNumber = KeGetProcessorIndexFromNumber(&ProcNumber);
*(_DWORD *)(a4 + 252) = ProcessorIndexFromNumber;
v69 = ProcessorIndexFromNumber == -1;
goto LABEL_190;
}
v61 = v13 - 131094;
if( !v61 )
{
if( v11[1] != 8 )
goto LABEL_17;
v95 = v11[2];
v152 = v95;
if( v4 )
{
if( (v95 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v95 + 8 > 0x7FFFFFFF0000i64 || v95 + 8 < v95 )
MEMORY[0x7FFFFFFF0000] = 0;
}
PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 8ui64, 0x77736350ui64);
*(_QWORD *)(a4 + 472) = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
{
v14 = -1073741801;
goto LABEL_305;
}
*PoolWithQuotaTag = *(_QWORD *)v95;
v97 = *(_DWORD **)(a4 + 472);
if( (*v97 & 3) == 0 || (unsigned int)(v97[1] - 1) > 5 )
goto LABEL_17;
goto LABEL_247;
}
v62 = v61 - 1;
if( !v62 )
{
if( v11[1] != 524 )
goto LABEL_17;
v93 = (UINT8 *)v11[2];
v151 = v93;
if( v4 && ((unsigned __int64)(v93 + 524) > 0x7FFFFFFF0000i64 || v93 + 524 < v93) )
MEMORY[0x7FFFFFFF0000] = 0;
v94 = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 0x20Cui64, 0x634F7350ui64);
*(_QWORD *)(a4 + 424) = v94;
if( !v94 )
goto LABEL_52;
memmove(v94, v93, 0x20Cui64);
*(_DWORD *)(a4 + 432) = 524;
goto LABEL_247;
}
v63 = v62 - 1;
if( !v63 )
{
v76 = v11[1];
if( v76 != 40 )
goto LABEL_17;
v77 = v11[2];
v138 = v77;
if( v4 )
{
if( (v77 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v76 = 40i64;
v77 = v138;
}
v78 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v76, 0x70426E50ui64);
v79 = (UINT8 **)(a4 + 440);
v122 = a4 + 440;
*(_QWORD *)(a4 + 440) = v78;
if( !v78 )
goto LABEL_52;
*v78 = 0i64;
v78[1] = 0i64;
*((_QWORD *)v78 + 4) = 0i64;
memmove(*v79, (UINT8 *)v77, v76);
v80 = v139;
v81 = *v79;
v122 = (INT64)v81;
v82 = (UINT8 *)*((_QWORD *)v81 + 1);
v150 = v82;
v148 = v82;
v83 = (UINT8 *)*((_QWORD *)v81 + 3);
v149 = v83;
*((_QWORD *)v81 + 1) = 0i64;
*((_QWORD *)*v79 + 3) = 0i64;
v84 = *(_WORD *)v81;
if( *(_WORD *)v81 )
{
v85 = *((unsigned __int16 *)v81 + 1);
if( v84 > (unsigned __int16)v85 || (v84 & 1) != 0 || (v85 & 1) != 0 || (_WORD)v85 == 0xFFFF || !v82 )
goto LABEL_17;
v86 = a2;
if( a2 && (_WORD)v85 && ((unsigned __int64)&v82[v85] > 0x7FFFFFFF0000i64 || &v82[v85] < v82) )
MEMORY[0x7FFFFFFF0000] = 0;
}
else
{
v86 = a2;
}
v87 = *((unsigned int *)*v79 + 4);
v88 = *v79;
if( (_DWORD)v87 )
{
if( !v83 || (unsigned int)v87 > 0xFFFF )
goto LABEL_17;
if( v86 )
{
v89 = 8 * v87;
if( v89 )
{
if( ((unsigned __int8)v83 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v90 = (unsigned __int64)&v83[v89];
if( v90 > 0x7FFFFFFF0000i64 || v90 < (unsigned __int64)v83 )
{
MEMORY[0x7FFFFFFF0000] = 0;
v88 = *(UINT8 **)(v80 + 440);
}
}
}
}
v91 = 0i64;
v120 = 0i64;
v92 = *((unsigned __int16 *)v81 + 1);
if( (_WORD)v92 || *((_DWORD *)v88 + 4) )
{
v91 = (UINT8 *)ExAllocatePoolWithQuotaTag(
(POOL_TYPE)520,
v92 + 8i64 * *((unsigned int *)v88 + 4),
0x70426E50ui64);
v120 = v91;
LOWORD(v92) = *((_WORD *)v81 + 1);
v82 = v150;
}
if( (_WORD)v92 )
{
*((_QWORD *)v81 + 1) = v91;
memmove(v91, v82, *((unsigned __int16 *)v81 + 1));
v91 += *((unsigned __int16 *)v81 + 1);
v120 = v91;
}
if( *((_DWORD *)*v79 + 4) )
{
*((_QWORD *)*v79 + 3) = v91;
memmove(*((UINT8 **)*v79 + 3), v83, 8i64 * *((unsigned int *)*v79 + 4));
}
goto LABEL_246;
}
v64 = v63 - 1;
if( v64 )
{
v65 = v64 - 2;
if( !v65 )
{
v71 = v11[1];
if( v71 > 0x18 )
goto LABEL_17;
*(_OWORD *)v160 = 0i64;
v161 = 0i64;
v72 = v11[2];
if( v4 && v72 >= 0x7FFFFFFF0000i64 )
v72 = 0x7FFFFFFF0000i64;
memmove(v160, (UINT8 *)v72, v71);
v73 = *(_OWORD *)v160;
*(_OWORD *)v156 = *(_OWORD *)v160;
v74 = v161;
v157 = v161;
v14 = PspValidateMitigationAuditOptions((INT64)v156);
if( v14 < 0 )
goto LABEL_305;
*(_OWORD *)(a4 + 488) = v73;
*(_QWORD *)(a4 + 504) = v74;
goto LABEL_247;
}
v66 = v65 - 2;
if( v66 )
{
if( v66 != 65519 || !(_DWORD)a3 || v11[1] != 16 )
goto LABEL_17;
v67 = v11[2];
v136 = v67;
if( v4 )
{
if( (v67 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v67 = v136;
}
*(_OWORD *)(a4 + 320) = *(_OWORD *)v67;
valid = KeVerifyGroupAffinity((GROUP_AFFINITY *)(a4 + 320), 1u);
LABEL_189:
v69 = valid == 0;
LABEL_190:
if( v69 )
goto LABEL_17;
LABEL_247:
v12 = 0x7FFFFFFF8i64;
LODWORD(a3) = v163;
v4 = a2;
goto LABEL_248;
}
if( v11[1] != 4 )
goto LABEL_17;
v70 = v11[2];
v146 = v70;
if( v4 )
{
if( (v70 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v70 + 4 > 0x7FFFFFFF0000i64 || v70 + 4 < v70 )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (*(_DWORD *)v70 & 0xFFFFFFFE) != 0 )
return 3221225485i64;
*(_QWORD *)(a4 + 480) = v70;
}
else
{
if( v11[1] != 4 )
goto LABEL_17;
v75 = v11[2];
v137 = v75;
if( v4 )
{
if( (v75 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v75 = v137;
}
*(_DWORD *)(a4 + 448) = *(_DWORD *)v75;
}
}
}
else if( v13 == 131093 )
{
if( v11[1] != 4 )
goto LABEL_17;
v60 = v11[2];
v135 = v60;
if( v4 )
{
if( (v60 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v60 = v135;
}
*(_DWORD *)(a4 + 420) = *(_DWORD *)v60;
}
else if( v13 > 0x2000A )
{
v38 = v13 - 131083;
if( !v38 )
{
v57 = v11[1];
if( !v57 || (v57 & 7) != 0 || (v57 & 0xFFFFFFFFFFFFFFF8ui64) > v12 )
goto LABEL_17;
v58 = (UINT8 *)v11[2];
v134 = v58;
if( v4 )
{
if( ((unsigned __int8)v58 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v58[v57] > 0x7FFFFFFF0000i64 || &v58[v57] < v58 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v59 = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v57, 0x6C487350ui64);
*(_QWORD *)(a4 + 296) = v59;
if( !v59 )
{
LABEL_52:
v14 = -1073741670;
goto LABEL_305;
}
memmove(v59, v58, v57);
*(_DWORD *)(a4 + 292) = v57 >> 3;
goto LABEL_247;
}
v39 = v38 - 2;
if( !v39 )
{
if( v11[1] != 2 )
goto LABEL_17;
v56 = v11[2];
v133 = v56;
if( v4 )
{
if( (v56 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v56 = v133;
}
v112 = *(_WORD *)v56;
if( *(_WORD *)v56 >= (unsigned __int16)KeNumberNodes )
goto LABEL_17;
_mm_lfence();
if( !*(_QWORD *)(*((_QWORD *)&KeNodeBlock + v112) + 136i64) )
goto LABEL_17;
*(_WORD *)(a4 + 250) = v112;
LABEL_158:
v11 = v111;
goto LABEL_248;
}
v40 = v39 - 3;
if( !v40 )
{
v52 = v11[1];
if( v52 > 0x18 )
goto LABEL_17;
*(_OWORD *)dst = 0i64;
v159 = 0i64;
v53 = v11[2];
if( v4 && v53 >= 0x7FFFFFFF0000i64 )
v53 = 0x7FFFFFFF0000i64;
memmove(dst, (UINT8 *)v53, v52);
v54 = *(_OWORD *)dst;
*(_OWORD *)MitigationOptions = *(_OWORD *)dst;
v55 = v159;
v155 = v159;
v14 = PspValidateMitigationOptions((UINT64)MitigationOptions, 0i64);
if( v14 < 0 )
goto LABEL_305;
*(_OWORD *)(a4 + 360) = v54;
*(_QWORD *)(a4 + 376) = v55;
goto LABEL_247;
}
v41 = v40 - 2;
if( !v41 )
{
v49 = v11[1];
if( !v49 || (v49 & 7) != 0 || v49 > 0x88 )
goto LABEL_17;
v50 = (UINT8 *)v11[2];
v145 = v50;
if( v4 )
{
if( ((unsigned __int8)v50 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v50[v49] > 0x7FFFFFFF0000i64 || &v50[v49] < v50 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v51 = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v49, 0x61547350ui64);
*(_QWORD *)(a4 + 392) = v51;
if( !v51 )
goto LABEL_52;
memmove(v51, v50, v49);
*(_DWORD *)(a4 + 408) = v49;
if( !IsTrustletCreateAttributeWellFormed(*(_QWORD **)(a4 + 392), v49) )
goto LABEL_17;
goto LABEL_247;
}
v42 = v41 - 1;
if( !v42 )
{
v44 = v11[1];
if( !v44 || (v44 & 7) != 0 || (v44 & 0xFFFFFFFFFFFFFFF8ui64) > v12 )
goto LABEL_17;
v45 = v11[2];
v134 = (UINT8 *)v45;
if( v4 )
{
if( (v45 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v45 + v44 > 0x7FFFFFFF0000i64 || v45 + v44 < v45 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v46 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v44, 0x6C4A7350ui64);
*(_QWORD *)(a4 + 400) = v46;
if( !v46 )
goto LABEL_52;
memset((INT64)v46, 0i64);
*(_DWORD *)(a4 + 412) = v44 >> 3;
v47 = 0i64;
v132 = 0i64;
for( i = 0i64; i < *(unsigned int *)(a4 + 412); ++i )
{
v14 = ObpReferenceObjectByHandleWithTag(
*(_QWORD *)(v45 + 8 * v47),
1,
(__int64)PsJobType,
a2,
0x6C4A7350u,
(__int64)&v131,
0i64,
0i64);
if( v14 < 0 )
goto LABEL_305;
*(_QWORD *)(*(_QWORD *)(a4 + 400) + 8 * v47) = v131;
v47 = i + 1;
v132 = i + 1;
}
LABEL_246:
v6 = v121;
goto LABEL_247;
}
if( v42 != 1 || v11[1] != 4 )
goto LABEL_17;
v43 = v11[2];
v130 = v43;
if( v4 )
{
if( (v43 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v43 = v130;
}
*(_DWORD *)(a4 + 416) = *(_DWORD *)v43;
}
else if( v13 == 131082 )
{
if( v11[1] != 8 )
goto LABEL_17;
v36 = v11[2];
v129 = v36;
if( v4 )
{
if( (v36 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v36 = v129;
}
if( (*(_DWORD *)v36 & 0x1C) != 0 )
{
v14 = -1073741637;
goto LABEL_305;
}
v37 = *(_DWORD *)v36 & 3;
v118 = v37;
if( (unsigned __int8)v37 >= 3u )
goto LABEL_17;
*(_BYTE *)(a4 + 9) ^= (*(_BYTE *)(a4 + 9) ^ (4 * v37)) & 0xC;
if( v37 == 1 )
*(_DWORD *)(a4 + 288) = *(_DWORD *)(v36 + 4);
}
else
{
v16 = v13 - 6;
if( v16 )
{
v17 = v16 - 65533;
if( v17 )
{
v18 = v17 - 1;
if( v18 )
{
v19 = v18 - 65537;
if( !v19 )
{
v27 = v11[1];
if( !v27 || (v27 & 1) != 0 || v27 > 0xFFFF )
goto LABEL_17;
v28 = (UINT8 *)v11[2];
v143 = v28;
if( v4 && ((unsigned __int64)&v28[v27] > 0x7FFFFFFF0000i64 || &v28[v27] < v28) )
MEMORY[0x7FFFFFFF0000] = 0;
v29 = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v27, 0x6E467350ui64);
v144 = v29;
if( !v29 )
goto LABEL_52;
*(_OWORD *)(a4 + 232) = 0i64;
*(_WORD *)(a4 + 234) = v27;
*(_QWORD *)(a4 + 240) = v29;
memmove(v29, v28, v27);
*(_WORD *)(a4 + 232) = v27;
goto LABEL_247;
}
v20 = v19 - 2;
if( !v20 )
{
v24 = v11[1];
if( !v24 || (v24 & 0xF) != 0 )
goto LABEL_17;
v25 = (UINT8 *)v11[2];
v142 = v25;
if( v4 )
{
if( ((unsigned __int8)v25 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v25[v24] > 0x7FFFFFFF0000i64 || &v25[v24] < v25 )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( v24 > 0x10 )
{
*(_QWORD *)(v6 + 280) = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v24, 0x6C527350ui64);
v26 = *(UINT8 **)(a4 + 280);
if( !v26 )
goto LABEL_52;
}
else
{
v26 = (UINT8 *)(a4 + 264);
*(_QWORD *)(v6 + 280) = a4 + 264;
}
memmove(v26, v25, v24);
*(_QWORD *)(a4 + 256) = v24 >> 4;
goto LABEL_247;
}
v21 = v20 - 1;
if( v21 )
{
if( v21 != 1 || v11[1] != 4 )
goto LABEL_17;
v22 = v11[2];
v124 = v22;
if( v4 )
{
if( (v22 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v111;
v22 = v124;
}
*(_DWORD *)(a4 + 316) = *(_DWORD *)v22;
}
else
{
if( v11[1] != 1 )
goto LABEL_17;
v23 = (_BYTE *)v11[2];
v125 = v23;
if( v4 )
{
v11 = v111;
v23 = v125;
}
*(_BYTE *)(a4 + 248) = *v23;
}
}
else
{
if( v11[1] != 8 )
goto LABEL_17;
v30 = v11[2];
v126 = v30;
if( v4 )
{
if( (v30 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v30 >= 0x7FFFFFFF0000i64 )
v30 = 0x7FFFFFFF0000i64;
*(_BYTE *)v30 = *(_BYTE *)v30;
*(_BYTE *)(v30 + 7) = *(_BYTE *)(v30 + 7);
v11 = v111;
v30 = v126;
}
*(_QWORD *)(a4 + 24) = v30;
v31 = v11[3];
v113 = v31;
if( v31 )
{
if( v4 )
{
if( (v31 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v31 >= 0x7FFFFFFF0000i64 )
v31 = 0x7FFFFFFF0000i64;
*(_BYTE *)v31 = *(_BYTE *)v31;
*(_BYTE *)(v31 + 7) = *(_BYTE *)(v31 + 7);
v11 = v111;
v31 = v113;
}
*(_QWORD *)v31 = 8i64;
}
}
}
else
{
if( v11[1] != 16 )
goto LABEL_17;
v32 = v11[2];
v127 = v32;
if( v4 )
{
if( (v32 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v32 >= 0x7FFFFFFF0000i64 )
v32 = 0x7FFFFFFF0000i64;
*(_BYTE *)v32 = *(_BYTE *)v32;
*(_BYTE *)(v32 + 15) = *(_BYTE *)(v32 + 15);
v32 = v127;
v11 = v111;
}
*(_QWORD *)(a4 + 16) = v32;
v33 = v11[3];
v114 = v33;
if( v33 )
{
if( v4 )
{
if( (v33 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v33 >= 0x7FFFFFFF0000i64 )
v33 = 0x7FFFFFFF0000i64;
*(_BYTE *)v33 = *(_BYTE *)v33;
*(_BYTE *)(v33 + 7) = *(_BYTE *)(v33 + 7);
v11 = v111;
v33 = v114;
}
*(_QWORD *)v33 = 16i64;
}
}
}
else
{
if( v11[1] != 64 )
goto LABEL_17;
v34 = v11[2];
v128 = v34;
if( v4 )
{
if( (v34 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v34 >= 0x7FFFFFFF0000i64 )
v34 = 0x7FFFFFFF0000i64;
*(_BYTE *)v34 = *(_BYTE *)v34;
*(_BYTE *)(v34 + 63) = *(_BYTE *)(v34 + 63);
v11 = v111;
v34 = v128;
}
*(_QWORD *)(a4 + 32) = v34;
v35 = v11[3];
v115 = v35;
if( v35 )
{
if( v4 )
{
if( (v35 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v35 >= 0x7FFFFFFF0000i64 )
v35 = 0x7FFFFFFF0000i64;
*(_BYTE *)v35 = *(_BYTE *)v35;
*(_BYTE *)(v35 + 7) = *(_BYTE *)(v35 + 7);
v11 = v111;
v35 = v115;
}
*(_QWORD *)v35 = 64i64;
}
}
}
LABEL_248:
v11 += 4;
v111 = v11;
v10 = --v117;
}
v14 = 0;
LABEL_305:
if( v14 < 0 )
goto LABEL_311;
if( (*(_DWORD *)(a4 + 4) & 0x800) != 0 )
{
qsort(*(WCHAR **)(a4 + 296), *(unsigned int *)(a4 + 292), (const WCHAR *)8, PspSortHandleList);
if( **(int **)(a4 + 296) < 0 )
v14 = -1073741811;
*(_BYTE *)(a4 + 8) = *(_BYTE *)(a4 + 8) & 0xFE | (v119 != 0);
}
if( v14 < 0 )
LABEL_311:
PspDeleteCreateProcessContext(a4);
return(unsigned int)v14;
}Referenced by:
NtCreateThreadEx
NtCreateUserProcess