KiLockExtendedServiceTable
INT64 __stdcall KiLockExtendedServiceTable(PVOID BugCheckParameter1){
ULONG_PTR v1;
unsigned int v2;
int v3;
ULONG_PTR v4;
char v5;
ULONG_PTR v6;
__int64 CurrentProcess;
signed __int32 SessionId;
unsigned __int128 v9;
unsigned int v10;
unsigned __int64 v11;
ULONG_PTR v12;
_QWORD *v13;
char *v14;
unsigned int v15;
unsigned __int64 v16;
__int64 v17;
unsigned __int64 v18;
__int64 *v19;
__int64 v20;
unsigned __int64 v21;
char v22;
int v23;
unsigned int v24;
unsigned __int64 v25;
__int64 v26;
__int64 v27;
_QWORD *v28;
char v29;
__int64 v30;
unsigned int v31;
__int64 v32;
__int64 v33;
__int64 *v34;
__int64 v35;
unsigned __int64 v36;
char v37;
unsigned int v38;
unsigned __int64 v39;
ULONG_PTR v40;
PVOID *v41;
ULONG_PTR v42;
__int64 v43;
void *v44;
char v45;
IMAGE_NT_HEADERS *v46;
char *v47;
int v48;
int v49;
__int16 v50;
int v51;
char *v52;
char v53;
char v54;
char *v55;
unsigned int v56;
char *v57;
__int64 v58;
__int64 v59;
char v60;
char v61;
char *v62;
int v63;
char v64;
char v65;
char *v66;
int v67;
char v68;
char v69;
unsigned int v70;
char v71;
char *v72;
_QWORD *v73;
char *v74;
char *i;
ULONG_PTR v76;
unsigned int v77;
__int64 v78;
ULONG_PTR v79;
_QWORD *v80;
__int64 v81;
ULONG_PTR v82;
char v83;
int v84;
unsigned int v85;
unsigned __int64 v86;
ULONG_PTR v87;
int v88;
__int64 v89;
char *v90;
__int64 Size;
__int64 VirtualAddress;
char *v93;
char *v94;
__int64 v95;
char *v96;
__int64 v97;
__int64 *v98;
unsigned __int64 v99;
unsigned __int64 v100;
IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v101;
UINT64 v102;
IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v103;
INT64 v104;
char v105;
__int64 v106;
unsigned int v107;
_QWORD *v108;
unsigned __int64 v109;
_QWORD *v110;
char *v111;
unsigned __int64 v112;
unsigned int v113;
__int64 v114;
unsigned __int64 v115;
_QWORD *v116;
__int64 v117;
unsigned __int64 v118;
char v119;
int v120;
unsigned int v121;
unsigned __int64 v122;
__int64 v123;
unsigned __int64 v124;
int v126[6];
UINT64 TableSize;
PVOID BaseOfImage;
IMAGE_NT_HEADERS *v129;
__int64 v130;
unsigned __int64 v131;
__int64 v132;
ULONG_PTR BugCheckParameter3;
unsigned int *v134;
__int128 v135;
__int128 v136;
IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *FunctionTable;
UINT64 v138;
IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v139;
INT64 *v140;
__int64 v141;
__int64 v142;
__int64 v143;
ULONG_PTR BugCheckParameter2;
char v146;
int v147;
v146 = v3;
BugCheckParameter2 = v1;
v4 = v2;
v5 = v3;
v6 = (ULONG_PTR)BugCheckParameter1;
if( v3 )
{
CurrentProcess = PsGetCurrentProcess();
SessionId = MmGetSessionIdEx(CurrentProcess);
if( dword_140C0F148 == SessionId
|| (*(_QWORD *)&v9 = (unsigned int)_InterlockedCompareExchange(&dword_140C0F148, SessionId, -1), (_DWORD)v9 == -1) )
{
v10 = 4 * v4;
v11 = ((unsigned __int64)&qword_140C12EC0 ^ qword_140C12EC8) & 0x3F;
v12 = v6 + (unsigned int)(4 * v4);
v13 = (_QWORD *)v6;
v14 = (char *)v6;
if( v6 < v12 )
{
do
{
_mm_prefetchnta(v14);
v14 += 64;
}
while( (unsigned __int64)v14 < v12 );
}
v15 = v10 >> 7;
v16 = (unsigned __int64)&qword_140C12EC0 ^ qword_140C12EC8;
if( v10 >> 7 )
{
do
{
v17 = 8i64;
do
{
v18 = v16 ^ *v13;
v19 = v13 + 1;
v20 = *v19;
v13 = v19 + 1;
v16 = __ROL8__(__ROL8__(v18, v11) ^ v20, v11);
--v17;
}
while( v17 );
v21 = __ROL8__((unsigned __int64)&qword_140C12EC0 ^ qword_140C12EC8 ^ ((unsigned __int64)v13 - v6), 17) ^ (unsigned __int64)&qword_140C12EC0 ^ qword_140C12EC8 ^ ((unsigned __int64)v13 - v6);
v141 = (v21 * (unsigned __int128)0x7010008004002001ui64) >> 64;
v22 = v11 ^ v141 ^ v21;
LOBYTE(v11) = 1;
v23 = v22 & 0x3F;
if( v23 )
LOBYTE(v11) = v23;
--v15;
}
while( v15 );
v5 = v146;
}
v24 = v10 & 0x7F;
if( v24 >= 8 )
{
v25 = (unsigned __int64)v24 >> 3;
do
{
v16 = __ROL8__(*v13++ ^ v16, v11);
v24 -= 8;
--v25;
}
while( v25 );
}
for( ; v24; --v24 )
{
v26 = *(unsigned __int8 *)v13;
v13 = (_QWORD *)((char *)v13 + 1);
v16 = __ROL8__(v26 ^ v16, v11);
}
v27 = v16 ^ qword_140C12EC0;
BugCheckParameter3 = v4;
v28 = (_QWORD *)BugCheckParameter2;
v29 = (v16 ^ qword_140C12EC0) & 0x3F;
*(_QWORD *)&v9 = BugCheckParameter2;
if( BugCheckParameter2 < BugCheckParameter2 + v4 )
{
do
{
_mm_prefetchnta((void *)v9);
*(_QWORD *)&v9 = v9 + 64;
}
while( (unsigned __int64)v9 < BugCheckParameter2 + v4 );
}
v30 = v16 ^ qword_140C12EC0;
v31 = (unsigned int)v4 >> 7;
if( (unsigned int)v4 >> 7 )
{
do
{
v32 = 8i64;
do
{
v33 = v30 ^ *v28;
v34 = v28 + 1;
v35 = *v34;
v28 = v34 + 1;
v30 = __ROL8__(__ROL8__(v33, v29) ^ v35, v29);
--v32;
}
while( v32 );
v36 = __ROL8__(v27 ^ ((unsigned __int64)v28 - BugCheckParameter2), 17) ^ v27 ^ ((unsigned __int64)v28
- BugCheckParameter2);
v142 = (v36 * (unsigned __int128)0x7010008004002001ui64) >> 64;
v37 = v29 ^ v142 ^ v36;
v29 = 1;
*(_QWORD *)&v9 = v37 & 0x3F;
if( (_DWORD)v9 )
v29 = v9;
--v31;
}
while( v31 );
v5 = v146;
v6 = (ULONG_PTR)BugCheckParameter1;
}
v38 = v4 & 0x7F;
if( v38 >= 8 )
{
v39 = (unsigned __int64)v38 >> 3;
do
{
v30 = __ROL8__(*v28++ ^ v30, v29);
v38 -= 8;
--v39;
}
while( v39 );
}
for( ; v38; --v38 )
{
*(_QWORD *)&v9 = *(unsigned __int8 *)v28;
v28 = (_QWORD *)((char *)v28 + 1);
v30 = __ROL8__(v9 ^ v30, v29);
}
v40 = v6 ^ v30 ^ BugCheckParameter3;
if( (v5 & 2) != 0 )
{
qword_140C12EC8 = v6 ^ v30 ^ BugCheckParameter3;
}
else
{
v41 = (PVOID *)PsLoadedModuleList;
if( PsLoadedModuleList == &PsLoadedModuleList )
goto LABEL_141;
while( 1 )
{
v42 = (ULONG_PTR)v41[6];
if( v6 >= v42 && v6 < v42 + *((unsigned int *)v41 + 16) )
break;
v41 = (PVOID *)*v41;
if( v41 == &PsLoadedModuleList )
goto LABEL_141;
}
if( !v42 )
LABEL_141:
KeBugCheckEx(0x43u, v6, BugCheckParameter2, BugCheckParameter3, 0i64);
v147 = 0;
v43 = 0i64;
result[0] = (__int64)v41[6];
v132 = 0i64;
do
{
v44 = (void *)result[v43];
BaseOfImage = v44;
if( !v44 )
break;
v45 = v40 & 0x3F;
LODWORD(v130) = v40 & 0x3F;
v46 = RtlImageNtHeader(v44);
v129 = v46;
if( !v46 )
KeBugCheckEx(0x43u, (ULONG_PTR)BugCheckParameter1, BugCheckParameter2, BugCheckParameter3, 1ui64);
v47 = (char *)&v46->OptionalHeader + v46->FileHeader.SizeOfOptionalHeader;
v131 = (unsigned __int64)&v47[40 * v46->FileHeader.NumberOfSections];
do
{
v48 = 0;
if( (*((_DWORD *)v47 + 9) & 0x2000000) != 0
|| (v49 = *(_DWORD *)v47, *(_DWORD *)v47 == 1414090313) && *((_DWORD *)v47 + 1) == 1195525195
|| v49 == 1162297680 && ((v50 = *((_WORD *)v47 + 2), v50 == 30839) || v50 == 29303 || v50 == 30583)
|| v49 == 1095914053 && *((_WORD *)v47 + 2) == 16724 )
{
LABEL_72:
v48 = 1;
}
else
{
v51 = 7;
v52 = VfExcludeSections[0];
v135 = *(_OWORD *)VfExcludeSections;
v136 = *(_OWORD *)off_140C0EFE0;
while( 1 )
{
v53 = v52[v47 - VfExcludeSections[0]];
v54 = *v52++;
if( v53 != v54 )
break;
if( !--v51 )
goto LABEL_72;
}
v55 = (char *)*((_QWORD *)&v135 + 1);
v56 = 8;
v57 = v47;
while( 1 )
{
v58 = *(_QWORD *)v57;
v57 += 8;
v59 = *(_QWORD *)v55;
v55 += 8;
if( v58 != v59 )
break;
v56 -= 8;
if( v56 < 8 )
{
if( !v56 )
goto LABEL_72;
while( 1 )
{
v60 = *v57++;
v61 = *v55++;
if( v60 != v61 )
goto LABEL_65;
if( !--v56 )
goto LABEL_72;
}
}
}
LABEL_65:
v62 = (char *)v136;
v63 = 4;
while( 1 )
{
v64 = v47[(_QWORD)v62 - v136];
v65 = *v62++;
if( v64 != v65 )
break;
if( !--v63 )
goto LABEL_72;
}
v66 = (char *)*((_QWORD *)&v136 + 1);
v67 = 6;
while( 1 )
{
v68 = v47[(_QWORD)v66 - *((_QWORD *)&v136 + 1)];
v69 = *v66++;
if( v68 != v69 )
break;
if( !--v67 )
goto LABEL_72;
}
}
v70 = *((_DWORD *)v47 + 4);
if( *((int *)v47 + 9) < 0 )
v48 = 1;
if( !v48 )
{
v71 = v45;
if( v70 <= *((_DWORD *)v47 + 2) )
v70 = *((_DWORD *)v47 + 2);
v72 = (char *)BaseOfImage + *((unsigned int *)v47 + 3);
v73 = v72;
v74 = &v72[v70];
for( i = v72; i < v74; i += 64 )
_mm_prefetchnta(i);
v76 = v40;
v77 = v70 >> 7;
if( v70 >> 7 )
{
do
{
v78 = 8i64;
do
{
v79 = *v73 ^ v76;
v80 = v73 + 1;
v81 = *v80 ^ __ROL8__(v79, v71);
v73 = v80 + 1;
v76 = __ROL8__(v81, v71);
--v78;
}
while( v78 );
v82 = __ROL8__(v40 ^ ((char *)v73 - v72), 17) ^ v40 ^ ((char *)v73 - v72);
v143 = (v82 * (unsigned __int128)0x7010008004002001ui64) >> 64;
v83 = v71 ^ v143 ^ v82;
v71 = 1;
v84 = v83 & 0x3F;
if( v84 )
v71 = v84;
--v77;
}
while( v77 );
v45 = v130;
}
v85 = v70 & 0x7F;
if( v85 >= 8 )
{
v86 = (unsigned __int64)v85 >> 3;
do
{
v76 = __ROL8__(*v73++ ^ v76, v71);
v85 -= 8;
--v86;
}
while( v86 );
}
for( ; v85; --v85 )
{
v87 = v76 ^ *(unsigned __int8 *)v73;
v73 = (_QWORD *)((char *)v73 + 1);
v76 = __ROL8__(v87, v71);
}
v40 = v76;
}
v47 += 40;
}
while( v47 != (char *)v131 );
v88 = v147;
if( !v147 )
{
v89 = (__int64)v129;
v90 = (char *)BaseOfImage;
Size = v129->OptionalHeader.DataDirectory[1].Size;
if( (unsigned int)Size >= 0x14 )
{
VirtualAddress = v129->OptionalHeader.DataDirectory[1].VirtualAddress;
v93 = (char *)BaseOfImage + Size + VirtualAddress;
v94 = (char *)BaseOfImage + VirtualAddress;
if( (char *)BaseOfImage + VirtualAddress != v93 )
{
do
{
if( !*((_DWORD *)v94 + 3) )
break;
v95 = *((unsigned int *)v94 + 4);
if( !(_DWORD)v95 )
break;
v96 = *(char **)&v90[v95];
if( v96 && (v96 < v90 || v96 >= &v90[*(unsigned int *)(v89 + 80)]) )
{
if( (unsigned int)MmIsSessionAddress(v96) )
{
RtlPcToFileHeader(v96, &BaseOfImage);
if( BaseOfImage )
{
v97 = 0i64;
v98 = result;
while( (PVOID)*v98 != BaseOfImage )
{
if( !*v98 )
{
result[v97] = (__int64)BaseOfImage;
break;
}
v97 = (unsigned int)(v97 + 1);
++v98;
if( (unsigned int)v97 >= 0x10 )
break;
}
if( (_DWORD)v97 == 16 )
goto LABEL_115;
}
}
v89 = (__int64)v129;
}
v94 += 20;
}
while( v94 != v93 );
v88 = 0;
}
}
}
v43 = v132 + 1;
v147 = v88 + 1;
++v132;
}
while( (unsigned int)(v88 + 1) < 0x10 );
LABEL_115:
*(_QWORD *)&v9 = memset((INT64)result, 0i64);
if( v40 == qword_140C12EC0 || !v40 )
{
*(_QWORD *)&v9 = 0x95EA5DE843D5D824ui64;
v40 ^= 0x95EA5DE843D5D824ui64;
}
_InterlockedOr(v126, 0);
qword_140C12EC0 = v40;
}
}
}
else
{
v99 = (unsigned __int64)&qword_140C12ED0;
v100 = (unsigned __int64)&qword_140C12ED0 & 0x3F;
v131 = (unsigned __int64)&qword_140C12ED0 & 0x3F;
RtlImageNtHeader((PVOID)0x140000000i64);
RtlCaptureImageExceptionValues((PVOID)0x140000000i64, &FunctionTable, &TableSize);
v101 = FunctionTable;
v102 = 0x140000000ui64;
LODWORD(TableSize) = (unsigned int)TableSize / 0xC;
v138 = 0x140000000ui64;
v103 = (IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)FunctionTable + 12 * (unsigned int)TableSize);
v139 = v103;
v140 = (INT64 *)&v134;
while( v101 && v101 != v103 )
{
v104 = RtlpConvertFunctionEntry((INT64)v101, v102);
v105 = v100;
*v140 = v104;
v101 = (IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)FunctionTable + 12);
FunctionTable = (IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)FunctionTable + 12);
v106 = *v134;
v107 = v134[1] - v106;
v108 = (_QWORD *)(0x140000000i64 + v106);
v109 = 0x140000000i64 + v106 + v107;
v110 = v108;
v111 = (char *)v108;
if( (unsigned __int64)v108 < v109 )
{
do
{
_mm_prefetchnta(v111);
v111 += 64;
}
while( (unsigned __int64)v111 < v109 );
}
v112 = v99;
v113 = v107 >> 7;
if( v107 >> 7 )
{
do
{
v114 = 8i64;
do
{
v115 = *v110 ^ v112;
v116 = v110 + 1;
v117 = *v116 ^ __ROL8__(v115, v105);
v110 = v116 + 1;
v112 = __ROL8__(v117, v105);
--v114;
}
while( v114 );
v118 = __ROL8__(v99 ^ ((char *)v110 - (char *)v108), 17) ^ v99 ^ ((char *)v110 - (char *)v108);
v119 = v105 ^ ((v118 * (unsigned __int128)0x7010008004002001ui64) >> 64) ^ v118;
v105 = 1;
v120 = v119 & 0x3F;
if( v120 )
v105 = v120;
--v113;
}
while( v113 );
LOBYTE(v100) = v131;
}
v121 = v107 & 0x7F;
if( v121 >= 8 )
{
v122 = (unsigned __int64)v121 >> 3;
do
{
v112 = __ROL8__(*v110++ ^ v112, v105);
v121 -= 8;
--v122;
}
while( v122 );
}
for( ; v121; --v121 )
{
v123 = *(unsigned __int8 *)v110;
v110 = (_QWORD *)((char *)v110 + 1);
v112 = __ROL8__(v123 ^ v112, v105);
}
v103 = v139;
v102 = v138;
v99 = v112;
}
qword_140C12ED0 = v99;
if( qword_140C12EC0 )
KeBugCheckEx(0x31u, 0xFFFFFFFFC0000001ui64, 0i64, 0i64, 0i64);
v124 = __rdtsc();
v9 = (__ROR8__(v124, 3) ^ v124) * (unsigned __int128)0x7010008004002001ui64;
qword_140C12EC0 = v9 ^ *((_QWORD *)&v9 + 1);
if( (unsigned __int64)v9 == *((_QWORD *)&v9 + 1) )
{
*(_QWORD *)&v9 = 0x95EA5DE843D5D824ui64;
qword_140C12EC0 = 0x95EA5DE843D5D824ui64;
}
}
return v9;
}Referenced by:
KiLockServiceTable