ArbBuildAssignmentOrdering
__int64 __fastcall ArbBuildAssignmentOrdering(
__int64 a1,
__int64 a2,
__int64 a3,
__int64 (__fastcall *a4)(__int128 *, __int128 *)){
unsigned int v4;
_ETHREAD *CurrentThread;
INT64 v8;
INT64 v9;
int v10;
int RegistryValue;
_DWORD *p_TitleIndex;
char *v13;
__int128 *v14;
int v15;
int v16;
WCHAR *v17;
unsigned __int64 v18;
char *v19;
__int128 *i;
int v21;
WCHAR *v23;
unsigned __int64 v24;
void *v25;
void *v26;
UINT64 CreateOptions;
HANDLE Handle;
PVOID P;
void *KeyHandle;
__int128 v31;
unsigned __int64 v32;
unsigned __int64 v33;
__int64 v34;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
KEY_VALUE_FULL_INFORMATION *v36;
KEY_VALUE_FULL_INFORMATION *Information;
__int128 v38;
__int128 v39;
v4 = 0;
KeyHandle = 0i64;
Handle = 0i64;
v31 = 0i64;
v34 = 0i64;
v33 = 0i64;
v32 = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
P = 0i64;
v38 = 0i64;
v39 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
KeWaitForSingleObject(*(PVOID *)(a1 + 8), Executive, 0, 0, 0i64);
ArbFreeOrderingList();
ArbFreeOrderingList();
v10 = ArbInitializeOrderingList((_ARBITER_ORDERING_LIST *)(a1 + 56), v8);
if( v10 < 0 )
goto LABEL_49;
v10 = ArbInitializeOrderingList((_ARBITER_ORDERING_LIST *)(a1 + 72), v9);
if( v10 < 0 )
goto LABEL_49;
LODWORD(v31) = 7733366;
*((_QWORD *)&v31 + 1) = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Arbiters";
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v31;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v10 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
if( v10 < 0 )
goto LABEL_49;
LODWORD(v31) = 1966110;
*((_QWORD *)&v31 + 1) = L"AllocationOrder";
ObjectAttributes.RootDirectory = KeyHandle;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v31;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v10 = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
if( v10 < 0 )
{
LABEL_49:
p_TitleIndex = P;
goto LABEL_50;
}
RegistryValue = ArbpGetRegistryValue(Handle, (WCHAR *)L"Root", (KEY_VALUE_FULL_INFORMATION **)&P);
p_TitleIndex = P;
v10 = RegistryValue;
if( RegistryValue < 0 || !P )
goto LABEL_50;
if( *((_DWORD *)P + 1) == 1 )
{
v23 = (WCHAR *)((char *)P + *((unsigned int *)P + 2));
v24 = (unsigned __int64)*((unsigned int *)P + 3) >> 1;
v36 = 0i64;
if( v23[v24 - 1] )
goto LABEL_44;
v10 = ArbpGetRegistryValue(Handle, v23, &v36);
if( v10 < 0 )
goto LABEL_50;
ExFreePoolWithTag(p_TitleIndex, 0);
p_TitleIndex = &v36->TitleIndex;
}
ZwClose(Handle);
Handle = 0i64;
if( p_TitleIndex[1] != 10 )
goto LABEL_44;
v13 = (char *)p_TitleIndex + (unsigned int)p_TitleIndex[2] + 32;
v14 = (__int128 *)(v13 + 8);
if( v13 + 8 < &v13[32 * *((unsigned int *)v13 + 1) + 8] )
{
do
{
if( a4 )
{
v10 = a4(&v38, v14);
if( v10 < 0 )
goto LABEL_50;
}
else
{
v38 = *v14;
v39 = v14[1];
}
v15 = *(_DWORD *)(a1 + 32);
if( BYTE1(v38) == v15 || BYTE1(v38) == 7 && v15 == 3 )
{
v10 = (*(__int64(__fastcall **)(__int128 *, unsigned __int64 *, unsigned __int64 *, __int64 *, __int64 *))(a1 + 120))(
&v38,
&v33,
&v32,
&v34,
&v34);
if( v10 < 0 )
goto LABEL_50;
v10 = ArbAddOrdering((unsigned __int16 *)(a1 + 56), v33, v32);
if( v10 < 0 )
goto LABEL_50;
}
v14 += 2;
}
while( v14 < (__int128 *)&v13[32 * *((unsigned int *)v13 + 1) + 8] );
}
ExFreePoolWithTag(p_TitleIndex, 0);
*((_QWORD *)&v31 + 1) = L"ReservedResources";
ObjectAttributes.RootDirectory = KeyHandle;
LODWORD(CreateOptions) = 0;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v31;
P = 0i64;
p_TitleIndex = 0i64;
LODWORD(v31) = 2228258;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v10 = ZwCreateKey(&Handle, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
if( v10 < 0
|| (v16 = ArbpGetRegistryValue(Handle, (WCHAR *)L"Root", (KEY_VALUE_FULL_INFORMATION **)&P),
p_TitleIndex = P,
v10 = v16,
v16 < 0) )
{
LABEL_50:
if( KeyHandle )
ZwClose(KeyHandle);
if( Handle )
ZwClose(Handle);
if( p_TitleIndex )
ExFreePoolWithTag(p_TitleIndex, 0);
v25 = *(void **)(a1 + 64);
if( v25 )
{
ExFreePoolWithTag(v25, 0);
*(_DWORD *)(a1 + 56) = 0;
}
v26 = *(void **)(a1 + 80);
if( v26 )
{
ExFreePoolWithTag(v26, 0);
*(_DWORD *)(a1 + 72) = 0;
}
v4 = v10;
goto LABEL_40;
}
if( *((_DWORD *)P + 1) != 1 )
goto LABEL_21;
v17 = (WCHAR *)((char *)P + *((unsigned int *)P + 2));
v18 = (unsigned __int64)*((unsigned int *)P + 3) >> 1;
Information = 0i64;
if( v17[v18 - 1] )
{
LABEL_44:
v10 = -1073741811;
goto LABEL_50;
}
v10 = ArbpGetRegistryValue(Handle, v17, &Information);
if( v10 < 0 )
goto LABEL_50;
ExFreePoolWithTag(p_TitleIndex, 0);
p_TitleIndex = &Information->TitleIndex;
LABEL_21:
ZwClose(Handle);
Handle = 0i64;
v19 = (char *)p_TitleIndex + (unsigned int)p_TitleIndex[2] + 32;
for( i = (__int128 *)(v19 + 8); i < (__int128 *)&v19[32 * *((unsigned int *)v19 + 1) + 8]; i += 2 )
{
if( a4 )
{
v10 = a4(&v38, i);
if( v10 < 0 )
goto LABEL_50;
}
else
{
v38 = *i;
v39 = i[1];
}
v21 = *(_DWORD *)(a1 + 32);
if( BYTE1(v38) == v21 || BYTE1(v38) == 7 && v21 == 3 )
{
v10 = (*(__int64(__fastcall **)(__int128 *, unsigned __int64 *, unsigned __int64 *, __int64 *, __int64 *))(a1 + 120))(
&v38,
&v33,
&v32,
&v34,
&v34);
if( v10 < 0 )
goto LABEL_50;
v10 = ArbAddOrdering((unsigned __int16 *)(a1 + 72), v33, v32);
if( v10 < 0 )
goto LABEL_50;
v10 = ArbPruneOrdering((unsigned __int16 *)(a1 + 56), v33, v32);
if( v10 < 0 )
goto LABEL_50;
}
}
ExFreePoolWithTag(p_TitleIndex, 0);
ZwClose(KeyHandle);
KeyHandle = 0i64;
LABEL_40:
KeSetEvent(*(PRKEVENT *)(a1 + 8), 0);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v4;
}Referenced by:
ArbInitializeArbiterInstance