NtMapCMFModule
INT64 __fastcall NtMapCMFModule(
UINT64 What,
UINT64 Index,
UINT64 *CacheIndexOut,
UINT64 *CacheFlagsOut,
UINT64 *ViewSizeOut,
VOID **BaseAddress){
UINT64 *v6;
UINT64 *v7;
unsigned int v8;
CHAR v9;
unsigned int v10;
int v11;
int v12;
_ETHREAD *CurrentThread;
unsigned int v14;
unsigned int v15;
_DWORD *v16;
_ETHREAD *v17;
unsigned int v18;
unsigned int v19;
int v20;
unsigned int v21;
int v22;
bool v23;
PADAPTER_OBJECT *v24;
void *PoolWithTag;
PADAPTER_OBJECT v26;
NTSTATUS v27;
signed __int64 v28;
signed __int64 v29;
__int64 v30;
__int64 v31;
__int64 v32;
__int64 v33;
unsigned int v35;
int v36;
PVOID MappedBase;
CHAR PreviousMode;
unsigned int v39;
int v40;
ULONG_PTR ViewSize;
UINT64 DesiredAccess;
__int64 v43;
_LOADER_PARAMETER_BLOCK **v44;
unsigned int v45;
HANDLE Handle;
__int128 StartContext;
__int128 v48;
__int128 v49;
__int64 v50;
struct _KEVENT Event;
OBJECT_ATTRIBUTES ObjectAttributes;
_ETHREAD *v54;
int v55;
unsigned int v56;
v56 = Index;
v55 = What;
v6 = CacheFlagsOut;
v7 = CacheIndexOut;
v8 = Index;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
v43 = 0i64;
memset(&Event, 0, sizeof(Event));
Handle = 0i64;
StartContext = 0i64;
v48 = 0i64;
v49 = 0i64;
v50 = 0i64;
MappedBase = 0i64;
ViewSize = 0i64;
v36 = 0;
v39 = 0;
v9 = *((_BYTE *)KeGetCurrentThread() + 562);
PreviousMode = v9;
if( !v9 || InitSafeBootMode )
{
v10 = -1073741823;
LABEL_3:
v35 = v10;
goto LABEL_116;
}
v11 = What;
if( (What & 0xFFE0FE81) != 0 )
{
LABEL_6:
v10 = -1073741811;
goto LABEL_3;
}
v10 = MUIInitializeResourceLock(&CMFLock);
v35 = v10;
if( (v10 & 0xC0000000) == -1073741824 )
goto LABEL_116;
if( (v11 & 0x20000) != 0 )
{
if( (v11 & 0x180000) != 0 && (v11 & 0x40000) != 0 || (v11 & 0x180000) == 1572864 )
goto LABEL_6;
v12 = v11 & 0x1C0000;
if( v12 == (CMFFlagsCache & 0x1C0000) )
{
LABEL_12:
v10 = 0;
goto LABEL_3;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite(CMFLock, 1u);
if( v12 != (CMFFlagsCache & 0x1C0000) )
{
if( CMFDirectorySectionPointer )
{
if( !v12 )
{
v35 = -1073741637;
LABEL_31:
ExReleaseResourceLite(CMFLock);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v10 = v35;
goto LABEL_116;
}
if( CMFDirectorySectionPointer )
{
v14 = 0x80000000;
v45 = 0x80000000;
if( (CMFFlagsCache & 0x1C0000) != 0 )
v14 = -1073741824;
v45 = v14;
v35 = CMFCheckAccess(CMFDirectorySectionPointer, v14, v9);
if( (v35 & 0xC0000000) == -1073741824 )
goto LABEL_31;
}
}
v15 = v12 | CMFFlagsCache & 0xFFE3FFFF;
CMFFlagsCache = v15;
if( CMFDirectorySectionPointer && ((v15 & 0x80000) != 0 || (v15 & 0x100000) != 0) )
{
MappedBase = 0i64;
ViewSize = 104i64;
v43 = 0i64;
if( MmMapViewInSystemSpace(CMFDirectorySectionPointer, &MappedBase, &ViewSize) >= 0 )
{
v16 = MappedBase;
if( MappedBase )
{
if( ViewSize >= 0x68 )
{
*((_DWORD *)MappedBase + 12) &= 0xFFE3FFFF;
v16[12] |= (CMFFlagsCache & 0x80000) != 0 ? 0x80000 : 0x100000;
v16 = MappedBase;
}
MmUnmapViewInSystemSpace(v16);
MappedBase = 0i64;
}
}
CMFUnmapModules((CMFFlagsCache & 0x100000) != 0 ? 304 : 32);
CMFRegisterEventTime(4u);
}
}
v35 = 0;
goto LABEL_31;
}
v17 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v17 + 242);
LOBYTE(v10) = 1;
ExAcquireResourceSharedLite(CMFLock, v10);
if( !CMFFlagsCache )
{
v18 = v55 | 1;
LABEL_49:
v19 = v18 & 0xFFFFFECF;
v39 = v19;
v20 = v18 & 0x130;
v40 = (v19 & 0x40) != 0 ? 4 : 2;
v21 = (v19 & 0x40) != 0 ? -1073741824 : 0x80000000;
LODWORD(DesiredAccess) = v21;
v36 = 10000;
switch( v20 )
{
case 16:
if( (unsigned int)CMFCacheIndex < 0x2710 )
{
v36 = CMFCacheIndex;
LABEL_58:
v23 = (v19 & 2) != 0;
v24 = &CMFDirectorySectionPointer;
LABEL_69:
v44 = (_LOADER_PARAMETER_BLOCK **)v24;
v26 = *v24;
goto LABEL_73;
}
if( v8 < 0x2710 )
{
v36 = v8;
goto LABEL_58;
}
if( CMFFirstAccess )
{
CMFRegisterEventTime(1u);
CMFFirstAccess = 0;
}
break;
case 32:
if( v8 < 0x1E && CMFCacheIndex != 10000 )
{
v36 = CMFCacheIndex;
if( !CMFSegmentSectionPointer )
{
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0xF0ui64, 0x636D6650ui64);
MappedBase = PoolWithTag;
if( !PoolWithTag )
{
v35 = -1073741801;
goto LABEL_96;
}
memset((INT64)PoolWithTag, 0i64);
if( _InterlockedCompareExchange64(
(volatile signed __int64 *)&CMFSegmentSectionPointer,
(signed __int64)MappedBase,
0i64) )
{
ExFreePoolWithTag(MappedBase, 0);
}
MappedBase = 0i64;
v19 = v39;
}
v23 = (v19 & 4) != 0;
v24 = (PADAPTER_OBJECT *)((char *)CMFSegmentSectionPointer + 8 * v8);
goto LABEL_69;
}
break;
case 256:
v36 = CMFCacheIndex;
v24 = &CMFHitsSectionPointer;
v44 = (_LOADER_PARAMETER_BLOCK **)&CMFHitsSectionPointer;
if( CMFHitsSectionPointer )
goto LABEL_86;
CMFHitsLastFlushTime = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
v26 = CMFHitsSectionPointer;
v23 = (v19 & 8) != 0;
v19 = v39;
v24 = (PADAPTER_OBJECT *)v44;
LABEL_73:
if( !v26 )
{
ExReleaseResourceLite(CMFLock);
ExAcquireResourceExclusiveLite(CMFLock, 1u);
if( ((v19 ^ CMFFlagsCache) & 0x1C0000) != 0 && (CMFFlagsCache & 0x180000) != 0 )
{
v22 = -1073741823;
goto LABEL_56;
}
v21 = DesiredAccess;
if( !*v24 )
{
LODWORD(StartContext) = 0x8000000;
*(_QWORD *)((char *)&StartContext + 4) = __PAIR64__(DesiredAccess, v36);
BYTE12(StartContext) = v23;
*((_QWORD *)&v48 + 1) = __PAIR64__(v56, v19);
LODWORD(v49) = v40;
*((_QWORD *)&v49 + 1) = v24;
LODWORD(v50) = v20;
KeInitializeEvent(&Event, SynchronizationEvent, 0);
*(_QWORD *)&v48 = &Event;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 512;
ObjectAttributes.ObjectName = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v35 = PsCreateSystemThreadEx(
&Handle,
0x1FFFFFui64,
&ObjectAttributes,
0i64,
0i64,
(PKSTART_ROUTINE)CMFSystemThreadRoutine,
&StartContext,
0i64,
0i64);
if( (v35 & 0xC0000000) == -1073741824 )
goto LABEL_96;
ZwClose(Handle);
v27 = KeWaitForSingleObject(&Event, Executive, 0, 0, 0i64);
v35 = v27;
if( v27 )
{
if( v27 >= 0 )
v35 = -1073741823;
goto LABEL_96;
}
v39 = DWORD2(v48);
v35 = DWORD1(v49);
if( (DWORD1(v49) & 0xC0000000) == -1073741824 )
{
LABEL_96:
v7 = CacheIndexOut;
goto LABEL_97;
}
if( v20 == 16 )
CMFRegisterEventTime(2u);
}
ExConvertExclusiveToSharedLite(CMFLock);
}
LABEL_86:
MappedBase = 0i64;
ViewSize = 0i64;
v43 = 0i64;
if( BaseAddress )
{
if( v20 == 256 || (v35 = CMFCheckAccess(*v24, v21, PreviousMode), (v35 & 0xC0000000) != -1073741824) )
{
v54 = (_ETHREAD *)KeGetCurrentThread();
v35 = MmMapViewOfSection(*v44, *((_QWORD *)v54 + 23));
if( (v35 & 0xC0000000) == -1073741824 )
{
MappedBase = 0i64;
}
else if( v20 == 256 )
{
v28 = CMFHitsLastFlushTime;
v29 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
if( *(__int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart > CMFHitsLastFlushTime + 36000000000i64
&& v28 == _InterlockedCompareExchange64(
&CMFHitsLastFlushTime,
*(signed __int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart,
CMFHitsLastFlushTime)
&& CMFFlushHitsFile(MappedBase, ViewSize) < 0 )
{
_InterlockedCompareExchange64(&CMFHitsLastFlushTime, v28, v29);
}
}
}
}
goto LABEL_96;
}
v22 = -1073741811;
LABEL_56:
v35 = v22;
goto LABEL_96;
}
if( (CMFFlagsCache & 0xF) != 0 )
v18 = CMFFlagsCache & 0xF | v55 & 0xFFFFFFF0;
else
v18 = v55 | 1;
if( (CMFFlagsCache & 0x100000) != 0 )
{
if( (v18 & 0x10000) == 0 )
{
v35 = -1073741672;
goto LABEL_98;
}
v18 |= 0x100000u;
goto LABEL_47;
}
if( (CMFFlagsCache & 0x80000) == 0 )
{
if( (CMFFlagsCache & 0x40000) != 0 )
v18 |= 0x40000u;
goto LABEL_47;
}
if( (v18 & 0x130) != 32 || (v18 & 0x10000) != 0 )
{
v18 |= 0x80000u;
LABEL_47:
v8 = v56;
goto LABEL_49;
}
v35 = -1073741672;
LABEL_97:
v6 = CacheFlagsOut;
LABEL_98:
ExReleaseResourceLite(CMFLock);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v10 = v35;
if( (v35 & 0xC0000000) != -1073741824 )
{
v30 = 0x7FFFFFFF0000i64;
if( BaseAddress )
{
v31 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)BaseAddress < 0x7FFFFFFF0000i64 )
v31 = (__int64)BaseAddress;
*(_QWORD *)v31 = *(_QWORD *)v31;
*BaseAddress = MappedBase;
MappedBase = 0i64;
}
if( ViewSizeOut )
{
v32 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)ViewSizeOut < 0x7FFFFFFF0000i64 )
v32 = (__int64)ViewSizeOut;
*(_DWORD *)v32 = *(_DWORD *)v32;
*(_DWORD *)ViewSizeOut = ViewSize;
}
if( v7 )
{
v33 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)v7 < 0x7FFFFFFF0000i64 )
v33 = (__int64)v7;
*(_DWORD *)v33 = *(_DWORD *)v33;
*(_DWORD *)v7 = v36;
}
if( v6 )
{
if( (unsigned __int64)v6 < 0x7FFFFFFF0000i64 )
v30 = (__int64)v6;
*(_DWORD *)v30 = *(_DWORD *)v30;
*(_DWORD *)v6 = v39;
}
goto LABEL_12;
}
LABEL_116:
if( MappedBase )
{
MiUnmapViewOfSection(*((_QWORD *)KeGetCurrentThread() + 23), (unsigned __int64)MappedBase, 0, 0);
return v35;
}
return v10;
}Referenced by:
No references.