SepRmDispatchDataToLsa
INT64 __fastcall SepRmDispatchDataToLsa(INT64 a1){
int v2;
__int64 v3;
__int64 *ServerSiloGlobals;
__int64 *v5;
__int16 v6;
int v7;
unsigned int v8;
int v9;
UINT8 *v10;
UINT64 v12;
VOID *v13;
void *v14;
int v15;
VOID *LsaBufferAddress;
ULONG_PTR RegionSize;
INT64 result;
int v19;
int v20;
PVOID BaseAddress[58];
_WORD v22[20];
int v23;
UINT8 Src[468];
v2 = 0;
memset((INT64)&result, 0i64);
memset((INT64)v22, 0i64);
v3 = *(_QWORD *)(a1 + 56);
LsaBufferAddress = 0i64;
ServerSiloGlobals = PsGetServerSiloGlobals(v3);
v5 = ServerSiloGlobals + 98;
if( ServerSiloGlobals[99] )
{
v6 = *(_WORD *)(a1 + 36);
v23 = 0;
v7 = *(_DWORD *)(a1 + 16);
WORD1(result) = v6 + 48;
LOWORD(result) = v6 + 8;
v22[0] = *(_WORD *)(a1 + 48);
v22[1] = v22[0] + 40;
v19 = *(_DWORD *)(a1 + 32);
if( v7 == 1 )
{
v8 = *(_DWORD *)(a1 + 36);
v20 = 1;
if( v8 <= 0x1D0 )
{
memmove((UINT8 *)BaseAddress, (UINT8 *)(a1 + 24), v8);
goto LABEL_5;
}
}
else if( (unsigned int)(v7 - 4) <= 2 )
{
v12 = *(unsigned int *)(a1 + 36);
v13 = *(VOID **)(a1 + 24);
if( (unsigned int)v12 > 0x1D0 )
{
if( (unsigned int)v12 > 0x1000 )
{
v15 = SepAdtCopyToLsaSharedMemory((VOID *)*v5, v13, v12, &LsaBufferAddress);
v2 = v15;
if( v15 < 0 )
{
SepAuditFailed((unsigned int)v15);
LABEL_5:
if( v2 >= 0 )
{
if( *(_DWORD *)(a1 + 32) != 3 || *(_QWORD *)(a1 + 40) )
v9 = ZwRequestWaitReplyPort();
else
v9 = ZwRequestPort();
v2 = v9;
if( v9 >= 0 )
{
v10 = *(UINT8 **)(a1 + 40);
if( v10 )
memmove(v10, Src, *(unsigned int *)(a1 + 48));
v2 = v23;
}
if( v20 == 3 )
{
RegionSize = 0i64;
return(unsigned int)ZwFreeVirtualMemory((PVOID)*v5, BaseAddress, &RegionSize, 0x8000ui64);
}
}
return(unsigned int)v2;
}
v14 = LsaBufferAddress;
v20 = 3;
}
else
{
memmove((UINT8 *)v5[8], (UINT8 *)v13, v12);
v14 = (void *)v5[7];
v20 = 2;
}
v7 = *(_DWORD *)(a1 + 16);
BaseAddress[0] = v14;
LODWORD(result) = 3670032;
}
else
{
memmove((UINT8 *)BaseAddress, (UINT8 *)v13, v12);
v20 = 1;
}
if( (unsigned int)(v7 - 4) <= 1 )
ExFreePoolWithTag(*(PVOID *)(a1 + 24), 0);
goto LABEL_5;
}
return(unsigned int)-1073741811;
}
return 0i64;
}Referenced by:
SepAdtLogAuditRecord
SepRmCallLsa