ObpCreateHandle
__int64 __fastcall ObpCreateHandle(
int a1,
char *a2,
DWORD a3,
struct _ACCESS_STATE *a4,
unsigned int a5,
unsigned int a6,
char a7,
_ETHREAD *a8,
int a9,
PVOID *a10,
__int64 *a11){
__int16 v11;
char *v12;
_ETHREAD *v13;
struct _ACCESS_STATE *v14;
int v15;
struct _EX_RUNDOWN_REF *v16;
_HANDLE_TABLE *v17;
int v18;
ULONG_PTR v19;
__int16 v20;
char v21;
ULONG_PTR v22;
unsigned int *v23;
unsigned int v24;
signed __int64 v25;
signed __int64 v26;
signed __int64 v27;
unsigned int v28;
volatile signed __int64 *v29;
_ETHREAD *v30;
signed __int64 v31;
signed __int64 v32;
signed __int64 v33;
signed __int64 v34;
signed __int64 v35;
unsigned int v36;
volatile signed __int64 *PoolWithTag;
_ETHREAD *v38;
signed __int64 v39;
signed __int64 v40;
char v41;
ULONG_PTR v42;
_ETHREAD *v43;
PACCESS_STATE v44;
BOOL v45;
_ETHREAD *v46;
UINT8 v47;
int v48;
__int64 v49;
volatile signed __int64 *v50;
signed __int64 v51;
signed __int64 v52;
bool v53;
signed __int64 v54;
_ETHREAD *v55;
volatile INT64 *v56;
volatile signed __int64 *v57;
signed __int64 v58;
bool v59;
signed __int64 v60;
volatile signed __int64 *i;
int v62;
VOID *v63;
struct _EX_RUNDOWN_REF *v64;
struct _DMA_ADAPTER *v65;
unsigned __int64 v66;
__int64 v67;
signed __int64 v68;
signed __int64 v69;
signed __int64 v70;
unsigned int v71;
volatile signed __int64 *v72;
_ETHREAD *v73;
signed __int64 v74;
signed __int64 v75;
int v76;
volatile signed __int64 *v77;
signed __int64 v78;
signed __int64 v79;
bool v80;
signed __int64 v81;
_ETHREAD *v82;
volatile INT64 *v83;
volatile signed __int64 *v84;
signed __int64 v85;
signed __int64 v86;
int v87;
unsigned int v88;
struct _DMA_ADAPTER *v89;
_OBJECT_TYPE *v90;
volatile signed __int64 *j;
unsigned int v92;
int v93;
_HANDLE_TABLE *v94;
UINT64 v95;
$674F156C788F89EBCBFDC1492D6BA90B v96;
unsigned int v97;
unsigned int v98;
unsigned int NextHandleNeedingPool;
unsigned int v100;
$04A1C50C0EA344B0A9CE9732A4AEB0AE *v101;
_HANDLE_TABLE_ENTRY *FirstFreeHandleEntry;
__int64 HighValue;
signed int v104;
unsigned int v105;
volatile INT64 *p_HandleTableLock;
UINT8 HandleTableEntrySlow;
_HANDLE_TABLE_FREE_LIST *v108;
_HANDLE_TABLE *v109;
_ETHREAD *v110;
unsigned __int64 v111;
UINT8 v112;
void *v113;
__int64 v114;
void **v115;
__int64 v116;
CHAR v117;
PVOID *v118;
bool v119;
struct _DMA_ADAPTER *v120;
__int64 v121;
UNICODE_STRING *v122;
unsigned __int16 v123;
UINT16 *v124;
VOID *CurrentThreadProcessId;
PACCESS_STATE v126;
VOID *v127;
INT64 v128;
int v129;
_PRIVILEGE_SET *v130;
unsigned __int64 v131;
_ETHREAD *v132;
unsigned __int64 v133;
BOOL v134;
_ETHREAD *v135;
struct _ERESOURCE *v136;
_ETHREAD *v137;
unsigned __int64 v138;
UINT64 PreviouslyGrantedAccess;
UINT64 PreviouslyGrantedAccessa;
PPRIVILEGE_SET *Privileges;
PGENERIC_MAPPING GenericMapping;
UINT64 AccessMode;
INT64 AccessModea;
int GrantedAccess;
PACCESS_MASK GrantedAccessa;
char v148;
bool v149;
UINT64 CurrentAccess;
PVOID Object;
PACCESS_STATE AccessState;
SIZE_T NumberOfBytes;
ULONG_PTR BugCheckParameter1;
INT64 AccessStatus;
UINT64 AccessMask;
_ETHREAD *CurrentThread;
unsigned int v158;
_HANDLE_TABLE *HandleTable;
int v160;
INT64 DesiredAccess;
PVOID ReferencedNewObject;
UINT64 v163;
_OBJECT_TYPE *v164;
_HANDLE_TABLE_ENTRY_INFO ExtraInfo;
VOID *v166;
void *TargetHandle;
__int64 v168;
PVOID P;
LIST_ENTRY ThreadCallbackListHead;
PPRIVILEGE_SET v171;
__int64 v172;
PVOID v173;
UINT64 v174;
__int64 *v175;
unsigned __int64 v176;
__int64 v177;
PVOID *v178;
struct _PRIVILEGE_SET RequiredPrivileges;
v11 = a6;
v12 = a2;
v13 = a8;
v14 = a4;
v178 = a10;
v15 = a1;
v175 = a11;
ThreadCallbackListHead = 0i64;
LODWORD(AccessMask) = a3;
LODWORD(CurrentAccess) = 0;
ExtraInfo.AuditMask = 0;
ExtraInfo.MaxRelativeAccessMask = a9;
Object = a2;
AccessState = a4;
HIDWORD(DesiredAccess) = a1;
v16 = (struct _EX_RUNDOWN_REF *)*((_QWORD *)KeGetCurrentThread() + 23);
BugCheckParameter1 = (ULONG_PTR)v16;
v158 = a6;
CurrentThread = a8;
LODWORD(DesiredAccess) = 0;
ReferencedNewObject = 0i64;
v148 = 0;
P = 0i64;
BYTE4(CurrentAccess) = 0;
if( (a6 & 0x200) != 0 )
{
v17 = (_HANDLE_TABLE *)ObpKernelHandleTable;
BugCheckParameter1 = (ULONG_PTR)PsInitialSystemProcess;
LABEL_8:
HandleTable = v17;
goto LABEL_9;
}
if( *((_BYTE *)KeGetCurrentThread() + 586) != 1 )
{
v17 = *(_HANDLE_TABLE **)(*((_QWORD *)KeGetCurrentThread() + 23) + 1392i64);
goto LABEL_8;
}
HandleTable = (_HANDLE_TABLE *)ObReferenceProcessHandleTable(v16);
v17 = HandleTable;
if( !HandleTable )
return(unsigned int)-1073741558;
v15 = HIDWORD(DesiredAccess);
BYTE4(CurrentAccess) = 1;
LABEL_9:
v149 = v17 == (_HANDLE_TABLE *)ObpKernelHandleTable;
if( !v14 || v17 == (_HANDLE_TABLE *)ObpKernelHandleTable && !*((_DWORD *)v14 + 6) )
{
v62 = AccessMask;
if( (AccessMask & 0x2000000) != 0 )
{
v62 = AccessMask & 0xEDFFFFFF | 0x10000000;
LODWORD(AccessMask) = v62;
}
if( (v62 & 0xF0000000) != 0 )
{
RtlMapGenericMask(
&AccessMask,
(_GENERIC_MAPPING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*(v12 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)]
+ 76));
v62 = AccessMask;
}
goto LABEL_115;
}
v19 = (ULONG_PTR)(v12 - 48);
LODWORD(AccessStatus) = 0;
v20 = (_WORD)v12 - 48;
v21 = 1;
v22 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(v19 + 24) ^ (unsigned __int64)HIBYTE(v20)];
if( (v158 & 0x400) == 0 )
v21 = a7;
if( (unsigned int)(v15 - 1) > 1 )
{
v23 = (unsigned int *)((char *)v14 + 16);
v24 = *((_DWORD *)v14 + 4);
memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
if( (v24 & 0x2000000) != 0 )
{
v24 = v24 & 0xEDFFFFFF | 0x10000000;
*v23 = v24;
}
if( (v24 & 0xF0000000) != 0 )
{
RtlMapGenericMask((UINT64 *)v14 + 2, (_GENERIC_MAPPING *)(v22 + 76));
v24 = *v23;
}
if( (v24 & 0x1000000) != 0 )
{
RequiredPrivileges.Privilege[0].Attributes = 0;
RequiredPrivileges.Privilege[0].Luid = *(_LUID *)SeSecurityPrivilege;
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
if( !SePrivilegeCheck(&RequiredPrivileges, (SECURITY_SUBJECT_CONTEXT *)v14 + 1, v21) )
{
SePrivilegedServiceAuditAlarm(0i64, (SECURITY_SUBJECT_CONTEXT *)v14 + 1, &RequiredPrivileges, 0i64);
v18 = -1073741727;
goto LABEL_291;
}
*v23 &= ~0x1000000u;
*((_DWORD *)v14 + 5) |= 0x1000000u;
SeAppendPrivileges(v14, &RequiredPrivileges);
}
*((_DWORD *)v14 + 5) |= *v23;
*v23 = 0;
*((_DWORD *)v14 + 5) &= *(_DWORD *)(v22 + 92) | 0x1000000;
_m_prefetchw((const void *)(v19 + 40));
v25 = *(_QWORD *)(v19 + 40);
if( (v25 & 0xF) != 0 )
{
do
{
v26 = _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 40), v25 - 1, v25);
if( v25 == v26 )
break;
v25 = v26;
}
while( (v26 & 0xF) != 0 );
}
v27 = v25;
v28 = v25 & 0xF;
v29 = (volatile signed __int64 *)(v27 & 0xFFFFFFFFFFFFFFF0ui64);
if( v28 <= 1 && v29 )
{
if( v28 == 1 )
{
if( _InterlockedExchangeAdd64(v29 - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
v30 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v30 + 242);
ExAcquirePushLockSharedEx(v19 + 16, 0i64);
v29 = (volatile signed __int64 *)(*(_QWORD *)(v19 + 40) & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(v29 - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 16), 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)(v19 + 16));
KeAbPostRelease((PVOID)(v19 + 16));
KeLeaveCriticalRegion();
v14 = AccessState;
}
_m_prefetchw((const void *)(v19 + 40));
v31 = *(_QWORD *)(v19 + 40);
while( (v31 & 0xF) == 0 )
{
if( v29 != (volatile signed __int64 *)(v31 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v32 = v31;
v31 = _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 40), v31 + 15, v31);
if( v32 == v31 )
goto LABEL_41;
}
ObDereferenceSecurityDescriptor((PVOID)v29, 0xFui64);
}
LABEL_41:
*((_DWORD *)v14 + 5) &= ~(unsigned int)SeComputeCreatorDeniedRights(
(SECURITY_SUBJECT_CONTEXT *)v14 + 1,
v14,
*((unsigned int *)v14 + 5),
(PVOID)v29);
if( v29 )
ObDereferenceSecurityDescriptor((PVOID)v29, 1ui64);
goto LABEL_110;
}
LODWORD(v163) = 0;
v171 = 0i64;
LODWORD(NumberOfBytes) = 0;
v160 = 0;
if( *(INT64(__fastcall **)(VOID *, _SECURITY_OPERATION_CODE, UINT64 *, VOID *, UINT64 *, VOID **, _POOL_TYPE, _GENERIC_MAPPING *, CHAR))(v22 + 152) == SeDefaultObjectMethod )
{
_m_prefetchw((const void *)(v19 + 40));
v33 = *(_QWORD *)(v19 + 40);
if( (v33 & 0xF) != 0 )
{
do
{
v34 = _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 40), v33 - 1, v33);
if( v33 == v34 )
break;
v33 = v34;
}
while( (v34 & 0xF) != 0 );
}
v35 = v33;
v36 = v33 & 0xF;
PoolWithTag = (volatile signed __int64 *)(v35 & 0xFFFFFFFFFFFFFFF0ui64);
if( v36 <= 1 && PoolWithTag )
{
if( v36 == 1 )
{
if( _InterlockedExchangeAdd64(PoolWithTag - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
v38 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v38 + 242);
ExAcquirePushLockSharedEx(v19 + 16, 0i64);
PoolWithTag = (volatile signed __int64 *)(*(_QWORD *)(v19 + 40) & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(PoolWithTag - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 16), 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)(v19 + 16));
KeAbPostRelease((PVOID)(v19 + 16));
KeLeaveCriticalRegion();
}
_m_prefetchw((const void *)(v19 + 40));
v39 = *(_QWORD *)(v19 + 40);
while( (v39 & 0xF) == 0 )
{
if( PoolWithTag != (volatile signed __int64 *)(v39 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v40 = v39;
v39 = _InterlockedCompareExchange64((volatile signed __int64 *)(v19 + 40), v39 + 15, v39);
if( v40 == v39 )
goto LABEL_62;
}
ObDereferenceSecurityDescriptor((PVOID)PoolWithTag, 0xFui64);
}
LABEL_62:
v41 = 0;
if( !PoolWithTag && ((*(_BYTE *)(v22 + 66) & 8) != 0 || (*(_BYTE *)(v19 + 26) & 2) != 0) )
KeBugCheckEx(0x189u, v19, v22, 1ui64, 0i64);
v18 = 0;
}
else
{
v160 = 447;
LODWORD(NumberOfBytes) = ObpDefaultSecurityDescriptorLength;
PoolWithTag = (volatile signed __int64 *)ExAllocatePoolWithTag(
PagedPool,
(unsigned int)ObpDefaultSecurityDescriptorLength,
0x7153624Fui64);
if( !PoolWithTag )
{
v18 = -1073741670;
LODWORD(AccessStatus) = -1073741670;
goto LABEL_102;
}
v42 = v19 + 40;
v18 = (*(__int64(__fastcall **)(PVOID, __int64, int *, volatile signed __int64 *, SIZE_T *, ULONG_PTR, _DWORD, ULONG_PTR, char))(v22 + 152))(
Object,
1i64,
&v160,
PoolWithTag,
&NumberOfBytes,
v19 + 40,
*(_DWORD *)(v22 + 100),
v22 + 76,
v21);
if( v18 == -1073741789 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
LODWORD(ObpDefaultSecurityDescriptorLength) = NumberOfBytes;
PoolWithTag = (volatile signed __int64 *)ExAllocatePoolWithTag(
PagedPool,
(unsigned int)NumberOfBytes,
0x7153624Fui64);
if( !PoolWithTag )
{
v18 = -1073741670;
LODWORD(AccessStatus) = -1073741670;
goto LABEL_102;
}
LOBYTE(GrantedAccess) = v21;
v18 = (*(__int64(__fastcall **)(PVOID, __int64, int *, volatile signed __int64 *, SIZE_T *, ULONG_PTR, _DWORD, ULONG_PTR, int))(v22 + 152))(
Object,
1i64,
&v160,
PoolWithTag,
&NumberOfBytes,
v42,
*(_DWORD *)(v22 + 100),
v22 + 76,
GrantedAccess);
}
v41 = 1;
if( v18 < 0 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
LODWORD(AccessStatus) = v18;
goto LABEL_102;
}
}
if( PoolWithTag )
{
v43 = (_ETHREAD *)KeGetCurrentThread();
v44 = AccessState;
--*((_WORD *)v43 + 242);
LOBYTE(v36) = 1;
ExAcquireResourceSharedLite(*(PERESOURCE *)(*((_QWORD *)v44 + 6) + 48i64), v36);
if( *((_QWORD *)v44 + 4) )
{
v46 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v46 + 242);
LOBYTE(v45) = 1;
ExAcquireResourceSharedLite(*(PERESOURCE *)(*((_QWORD *)v44 + 4) + 48i64), v45);
}
LODWORD(PreviouslyGrantedAccess) = *((_DWORD *)v44 + 5);
v47 = SeAccessCheck(
(VOID *)PoolWithTag,
(SECURITY_SUBJECT_CONTEXT *)v44 + 1,
1u,
*((unsigned int *)v44 + 4),
PreviouslyGrantedAccess,
&v171,
(GENERIC_MAPPING *)(v22 + 76),
v21,
&v163,
&AccessStatus);
if( v171 )
{
SeAppendPrivileges(v44, v171);
CmSiFreeMemory(v171);
}
if( v47 )
{
v48 = v163;
*((_DWORD *)v44 + 5) |= v163;
*((_DWORD *)v44 + 4) &= ~(v48 | 0x2000000);
}
if( v21 )
SeOpenObjectAuditAlarmWithTransaction(
(UNICODE_STRING *)(v22 + 16),
Object,
0i64,
(PVOID)PoolWithTag,
v44,
0,
v47,
v21,
0i64,
(UINT8 *)v44 + 10);
ExReleaseResourceLite(*(PERESOURCE *)(*((_QWORD *)v44 + 6) + 48i64));
KeLeaveCriticalRegion();
v49 = *((_QWORD *)v44 + 4);
if( v49 )
{
ExReleaseResourceLite(*(PERESOURCE *)(v49 + 48));
KeLeaveCriticalRegion();
}
if( v41 )
{
ExFreePoolWithTag((PVOID)PoolWithTag, 0);
}
else
{
v50 = PoolWithTag - 4;
_m_prefetchw((const void *)(v50 + 1));
v51 = *((_QWORD *)v50 + 1);
v52 = v51 - 1;
v53 = v51 == 1;
if( v51 - 1 <= 0 )
{
LABEL_92:
if( !v53 )
__fastfail(0xEu);
v55 = (_ETHREAD *)KeGetCurrentThread();
v56 = &ObsSecurityDescriptorCache[2 * (unsigned __int8)*((_DWORD *)v50 + 4)];
--*((_WORD *)v55 + 242);
v57 = v56 + 1;
ExAcquirePushLockExclusiveEx((UINT64)v56, 0i64);
v58 = _InterlockedExchangeAdd64(v50 + 1, 0xFFFFFFFFFFFFFFFFui64);
v59 = v58 <= 1;
v60 = v58 - 1;
if( v59 )
{
if( v60 )
__fastfail(0xEu);
for( i = (volatile signed __int64 *)*v57; i != v50; i = (volatile signed __int64 *)*i )
v57 = i;
*v57 = *v50;
if( (_InterlockedExchangeAdd64(v56, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v56);
KeAbPostRelease((PVOID)v56);
KeLeaveCriticalRegionThread((__int64)v55);
ExFreePoolWithTag((PVOID)v50, 0x6353624Fu);
}
else
{
if( (_InterlockedExchangeAdd64(v56, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v56);
KeAbPostRelease((PVOID)v56);
KeLeaveCriticalRegionThread((__int64)v55);
}
}
else
{
while( 1 )
{
v54 = v51;
v51 = _InterlockedCompareExchange64(v50 + 1, v52, v51);
if( v54 == v51 )
break;
v52 = v51 - 1;
v53 = v51 == 1;
if( v51 - 1 <= 0 )
goto LABEL_92;
}
}
}
v53 = v47 == 0;
v13 = CurrentThread;
if( !v53 )
{
v14 = AccessState;
goto LABEL_110;
}
v18 = AccessStatus;
LABEL_102:
if( v18 < 0 )
goto LABEL_291;
v14 = AccessState;
v11 = v158;
v12 = (char *)Object;
goto LABEL_116;
}
v14 = AccessState;
LODWORD(AccessStatus) = v18;
*((_DWORD *)AccessState + 5) |= *((_DWORD *)AccessState + 4);
*((_DWORD *)v14 + 4) = 0;
LABEL_110:
v62 = *((_DWORD *)v14 + 5);
v11 = v158;
v12 = (char *)Object;
LABEL_115:
LODWORD(CurrentAccess) = v62;
LABEL_116:
v63 = 0i64;
v166 = 0i64;
if( v13 )
{
v63 = (VOID *)*((_QWORD *)v13 + 4);
v166 = v63;
}
v18 = ObpIncrementHandleCountEx(
SHIDWORD(DesiredAccess),
(__int64)&CurrentAccess,
BugCheckParameter1,
(__int64)v12,
a7,
v11,
(__int64)v63);
if( v18 < 0 )
goto LABEL_291;
if( v14 )
{
if( v13 )
{
v64 = (struct _EX_RUNDOWN_REF *)BugCheckParameter1;
v18 = ObpInsertOrLocateNamedObject(
(_EPROCESS *)BugCheckParameter1,
v12,
&CurrentAccess,
v14,
a7,
(_OBJECT_CREATE_INFORMATION *)v13,
&ReferencedNewObject);
if( v18 < 0 )
goto LABEL_292;
v65 = (struct _DMA_ADAPTER *)ReferencedNewObject;
if( ReferencedNewObject == v12 )
{
v65 = 0i64;
ReferencedNewObject = 0i64;
}
else
{
v12 = (char *)ReferencedNewObject;
Object = ReferencedNewObject;
v148 = 1;
}
}
else
{
v65 = (struct _DMA_ADAPTER *)ReferencedNewObject;
}
if( *((_BYTE *)v14 + 10) )
LOBYTE(v11) = v11 | 4;
}
else
{
v65 = (struct _DMA_ADAPTER *)ReferencedNewObject;
}
v66 = (unsigned __int8)*(v12 - 24);
v67 = (__int64)(v12 - 48);
v168 = v67;
v172 = BYTE1(v67);
v164 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ BYTE1(v67) ^ v66];
LODWORD(CurrentAccess) = (v164->TypeInfo.ValidAccessMask | 0x1000000) & CurrentAccess;
if( v14 )
{
_m_prefetchw((const void *)(v67 + 40));
v68 = *(_QWORD *)(v67 + 40);
if( (v68 & 0xF) != 0 )
{
do
{
v69 = _InterlockedCompareExchange64((volatile signed __int64 *)(v67 + 40), v68 - 1, v68);
if( v68 == v69 )
break;
v68 = v69;
}
while( (v69 & 0xF) != 0 );
}
v70 = v68;
v71 = v68 & 0xF;
v72 = (volatile signed __int64 *)(v70 & 0xFFFFFFFFFFFFFFF0ui64);
if( v71 <= 1 && v72 )
{
if( v71 == 1 )
{
if( _InterlockedExchangeAdd64(v72 - 3, 0xFui64) <= 0 )
__fastfail(0xEu);
}
else
{
v73 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v73 + 242);
ExAcquirePushLockSharedEx(v67 + 16, 0i64);
v72 = (volatile signed __int64 *)(*(_QWORD *)(v67 + 40) & 0xFFFFFFFFFFFFFFF0ui64);
if( _InterlockedExchangeAdd64(v72 - 3, 0x10ui64) <= 0 )
__fastfail(0xEu);
if( _InterlockedCompareExchange64((volatile signed __int64 *)(v67 + 16), 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)(v67 + 16));
KeAbPostRelease((PVOID)(v67 + 16));
KeLeaveCriticalRegion();
}
_m_prefetchw((const void *)(v67 + 40));
v74 = *(_QWORD *)(v67 + 40);
while( (v74 & 0xF) == 0 )
{
if( v72 != (volatile signed __int64 *)(v74 & 0xFFFFFFFFFFFFFFF0ui64) )
break;
v75 = v74;
v74 = _InterlockedCompareExchange64((volatile signed __int64 *)(v67 + 40), v74 + 15, v74);
if( v75 == v74 )
goto LABEL_148;
}
ObDereferenceSecurityDescriptor((PVOID)v72, 0xFui64);
}
LABEL_148:
v76 = SeComputeCreatorDeniedRights(
(SECURITY_SUBJECT_CONTEXT *)v14 + 1,
v14,
(unsigned int)CurrentAccess,
(PVOID)v72);
if( v72 )
{
v77 = v72 - 4;
_m_prefetchw((const void *)(v77 + 1));
v78 = *((_QWORD *)v77 + 1);
v79 = v78 - 1;
v80 = v78 == 1;
if( v78 - 1 <= 0 )
{
LABEL_152:
if( !v80 )
__fastfail(0xEu);
v82 = (_ETHREAD *)KeGetCurrentThread();
v83 = &ObsSecurityDescriptorCache[2 * (unsigned __int8)*((_DWORD *)v77 + 4)];
--*((_WORD *)v82 + 242);
v84 = v83 + 1;
ExAcquirePushLockExclusiveEx((UINT64)v83, 0i64);
v85 = _InterlockedExchangeAdd64(v77 + 1, 0xFFFFFFFFFFFFFFFFui64);
v59 = v85 <= 1;
v86 = v85 - 1;
if( v59 )
{
if( v86 )
__fastfail(0xEu);
for( j = (volatile signed __int64 *)*v84; j != v77; j = (volatile signed __int64 *)*j )
v84 = j;
*v84 = *v77;
if( (_InterlockedExchangeAdd64(v83, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v83);
KeAbPostRelease((PVOID)v83);
KeLeaveCriticalRegionThread((__int64)v82);
ExFreePoolWithTag((PVOID)v77, 0x6353624Fu);
}
else
{
if( (_InterlockedExchangeAdd64(v83, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v83);
KeAbPostRelease((PVOID)v83);
KeLeaveCriticalRegionThread((__int64)v82);
}
v14 = AccessState;
}
else
{
while( 1 )
{
v81 = v78;
v78 = _InterlockedCompareExchange64(v77 + 1, v79, v78);
if( v81 == v78 )
break;
v79 = v78 - 1;
v80 = v78 == 1;
if( v78 - 1 <= 0 )
goto LABEL_152;
}
}
}
v65 = (struct _DMA_ADAPTER *)ReferencedNewObject;
v87 = ~v76 & CurrentAccess;
v13 = CurrentThread;
LODWORD(CurrentAccess) = v87;
*((_DWORD *)v14 + 5) = v87;
ExtraInfo.AuditMask = *(_DWORD *)(*((_QWORD *)v14 + 9) + 28i64);
}
v88 = a5;
v89 = (struct _DMA_ADAPTER *)Object;
if( a5 )
ObReferenceObjectExWithTag(Object, a5);
if( v65 )
HalPutDmaAdapter(v65);
v90 = v164;
if( v13 && !v148 && v164 == ObpSymbolicLinkObjectType )
ObpCreateSymbolicLinkName((__int64)v89);
ThreadCallbackListHead.Blink = &ThreadCallbackListHead;
ThreadCallbackListHead.Flink = &ThreadCallbackListHead;
if( (v90->TypeInfo.ObjectTypeFlags & 0x40) != 0 && v90->CallbackList.Flink != &v90->CallbackList )
{
LODWORD(DesiredAccess) = CurrentAccess;
v18 = ObpPreInterceptHandleCreate(v89, v149, &DesiredAccess, &ThreadCallbackListHead);
if( v18 < 0 )
{
ObpDecrementHandleCount(BugCheckParameter1, v67);
if( a5 )
{
if( a5 > 1 )
_InterlockedExchangeAdd64((volatile signed __int64 *)v67, (int)(1 - a5));
HalPutDmaAdapter(v89);
}
goto LABEL_291;
}
if( !v149 )
{
LODWORD(CurrentAccess) = DesiredAccess;
if( v14 )
*((_DWORD *)v14 + 5) = DesiredAccess;
}
}
v92 = 0;
v177 = 0i64;
v93 = CurrentAccess & 0x1FFFFFF;
if( (v11 & 8) != 0 )
v93 |= 0x2000000u;
LODWORD(v177) = v93;
v176 = ((v67 & 0xFFFFFFFFFFFFFFF1ui64) << 16) | ((unsigned __int64)(v11 & 7) << 17) | 1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v94 = HandleTable;
v95 = 0i64;
v96 = HandleTable->1;
if( (*(_BYTE *)&v96 & 4) != 0 )
{
LABEL_217:
v110 = CurrentThread;
goto LABEL_218;
}
if( (*(_BYTE *)&v96 & 1) != 0 )
v97 = 0;
else
v97 = *((_DWORD *)KeGetPcr() + 105);
v98 = ExpFreeListCount;
v158 = v97;
LABEL_192:
NextHandleNeedingPool = v94->NextHandleNeedingPool;
v100 = v97;
while( 1 )
{
v101 = &v94->64 + v100;
if( v101->FreeLists[0].FirstFreeHandleEntry )
break;
LABEL_203:
v105 = v100 + 1;
++v92;
v100 = 0;
if( v105 != v98 )
v100 = v105;
if( v92 >= v98 )
{
p_HandleTableLock = (volatile INT64 *)&v94->HandleTableLock;
HandleTableEntrySlow = 1;
v108 = &v94->FreeLists[v158];
ExAcquirePushLockExclusiveEx((UINT64)&v94->HandleTableLock, 0i64);
if( NextHandleNeedingPool == HandleTable->NextHandleNeedingPool )
HandleTableEntrySlow = ExpAllocateHandleTableEntrySlow(HandleTable, v108);
if( (_InterlockedExchangeAdd64(p_HandleTableLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(p_HandleTableLock);
KeAbPostRelease((PVOID)p_HandleTableLock);
v92 = 0;
if( HandleTableEntrySlow )
{
v97 = v158;
v94 = HandleTable;
goto LABEL_192;
}
goto LABEL_216;
}
}
ExAcquirePushLockExclusiveEx((UINT64)&v94->FreeLists[v100].FreeListLock.Value, 0i64);
FirstFreeHandleEntry = v101->FreeLists[0].FirstFreeHandleEntry;
if( FirstFreeHandleEntry )
{
HighValue = FirstFreeHandleEntry->HighValue;
v101->FreeLists[0].FirstFreeHandleEntry = (_HANDLE_TABLE_ENTRY *)HighValue;
if( !HighValue )
v101->FreeLists[0].LastFreeHandleEntry = 0i64;
v104 = ++v101->FreeLists[0].HandleCount;
if( v104 > (signed int)v101->FreeLists[0].HighWaterMark )
v101->FreeLists[0].HighWaterMark = v104;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v101, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v101);
KeAbPostRelease(v101);
if( !FirstFreeHandleEntry )
{
v94 = HandleTable;
goto LABEL_203;
}
v95 = *(_QWORD *)(((unsigned __int64)FirstFreeHandleEntry & 0xFFFFFFFFFFFFF000ui64) + 8)
+ 4
* ((__int64)((__int64)FirstFreeHandleEntry - ((unsigned __int64)FirstFreeHandleEntry & 0xFFFFFFFFFFFFF000ui64)) >> 4);
if( ExtraInfo.AuditMask || a9 )
{
v109 = HandleTable;
if( (unsigned int)ExpSetHandleExtraInfo(HandleTable, (VOID *)v95, &ExtraInfo) )
{
ExpFreeHandleTableEntry(v109, (_EXHANDLE)v95, FirstFreeHandleEntry);
v95 = 0i64;
LABEL_216:
v88 = a5;
v14 = AccessState;
v67 = v168;
goto LABEL_217;
}
}
else
{
v109 = HandleTable;
}
v110 = CurrentThread;
if( v109->DebugInfo )
ExpUpdateDebugInfo(v109, CurrentThread, (VOID *)v95, 1ui64);
v67 = v168;
v88 = a5;
FirstFreeHandleEntry->HighValue = v177;
FirstFreeHandleEntry->LowValue = v176;
v14 = AccessState;
LABEL_218:
KeLeaveCriticalRegionThread((__int64)v110);
if( !v95 )
{
ObpDecrementHandleCount(BugCheckParameter1, v67);
if( v88 )
{
if( v88 > 1 )
_InterlockedExchangeAdd64((volatile signed __int64 *)v67, (int)(1 - v88));
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
}
v112 = v149;
v18 = -1073741670;
goto LABEL_286;
}
if( v14 )
{
v113 = 0i64;
if( (*(_BYTE *)(v67 + 26) & 0x20) == 0
|| (v111 = 0x140000000ui64,
v114 = *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(v67 + 26) & 0x3F)),
v115 = (void **)(v67 - v114),
v67 == v114) )
{
if( v166 )
v113 = v166;
}
else if( *v115 )
{
v113 = *v115;
}
else if( v166 )
{
ObpSetObjectAuditInfo(v67, &v166, 0);
}
else if( (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)v172 ^ (unsigned __int64)*(unsigned __int8 *)(v67 + 24)] != IoFileObjectType
|| (*(_DWORD *)(*((_QWORD *)Object + 1) + 52i64) & 0x10) == 0 )
{
v116 = *((_QWORD *)v14 + 9);
v117 = 0;
if( v116 && (v118 = *(PVOID **)(v116 + 56)) != 0i64 )
v117 = 1;
else
v118 = 0i64;
if( ObpAllocateAndQuerySecurityDescriptorInfo(Object, 0x20ui64, v118) >= 0 )
{
v113 = P;
ObpSetObjectAuditInfo(v67, &P, v117);
}
}
v119 = 0;
TargetHandle = 0i64;
v174 = v95;
v120 = 0i64;
v121 = *((_QWORD *)v14 + 9);
if( !v113 )
{
v113 = *(void **)(v121 + 56);
if( !v113 )
v113 = (void *)*((_QWORD *)v14 + 8);
}
if( *((_BYTE *)v14 + 9) )
{
if( *((_BYTE *)v14 + 124) )
{
LODWORD(AccessMode) = *((_DWORD *)v14 + 5);
SepAdtPrivilegeObjectAuditAlarm(
(_UNICODE_STRING *)&SeSubsystemName,
(_UNICODE_STRING *)v14 + 9,
(_UNICODE_STRING *)v14 + 8,
(VOID *)v95,
*((_TOKEN **)v14 + 4),
*((_TOKEN **)v14 + 6),
*((VOID **)v14 + 7),
AccessMode,
*(_PRIVILEGE_SET **)v121,
1u);
goto LABEL_260;
}
}
else if( !*(_BYTE *)(v121 + 216) )
{
goto LABEL_260;
}
LODWORD(GenericMapping) = 2;
LODWORD(Privileges) = 512;
LODWORD(PreviouslyGrantedAccessa) = 0;
if( ZwDuplicateObject(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
(PVOID)v95,
(PVOID)0xFFFFFFFFFFFFFFFFi64,
&TargetHandle,
PreviouslyGrantedAccessa,
(UINT64)Privileges,
(UINT64)GenericMapping) >= 0 )
{
v173 = 0i64;
ObReferenceObjectByHandle(TargetHandle, 0, 0i64, 0, &v173, 0i64);
v120 = (struct _DMA_ADAPTER *)v173;
}
v122 = (UNICODE_STRING *)((char *)v14 + 144);
LOWORD(NumberOfBytes) = SepAdtClassifyObjectIntoSubCategory(v120, (_UNICODE_STRING *)v14 + 9, 1u, 0);
v123 = NumberOfBytes;
if( v120 )
HalPutDmaAdapter(v120);
if( TargetHandle )
{
ZwClose(TargetHandle);
TargetHandle = 0i64;
}
v124 = (UINT16 *)((char *)v14 + 128);
CurrentThreadProcessId = PsGetCurrentThreadProcessId();
v126 = AccessState;
v119 = SepAdtOpenObjectAuditAlarm(
v123,
(__int64)&SeSubsystemName,
&v174,
&v122->Length,
(__int64)v124,
v113,
*((_QWORD *)AccessState + 4),
*((_QWORD *)AccessState + 6),
*((_DWORD *)AccessState + 6),
*((_DWORD *)AccessState + 5),
*(_QWORD *)v121,
1,
(__int64)CurrentThreadProcessId,
2,
0i64,
0,
0i64,
v121 + 32,
(__int64)AccessState);
v127 = PsGetCurrentThreadProcessId();
LODWORD(GrantedAccessa) = *((_DWORD *)v126 + 5);
LODWORD(AccessModea) = *((_DWORD *)v126 + 6);
SepAdtStagingEvent(
NumberOfBytes,
v128,
&v174,
v122,
v124,
*((_QWORD *)v126 + 4),
*((_QWORD *)v126 + 6),
AccessModea,
(INT64)GrantedAccessa,
1u,
(INT64)v127,
(INT64)v126);
v67 = v168;
v14 = v126;
LABEL_260:
v129 = HIDWORD(DesiredAccess);
*((_BYTE *)v14 + 10) = v119;
if( !v129 )
{
v130 = (_PRIVILEGE_SET *)**((_QWORD **)v14 + 9);
if( v130 )
{
if( v130->PrivilegeCount )
SePrivilegeObjectAuditAlarm(
(PVOID)v95,
(_SECURITY_SUBJECT_CONTEXT *)v14 + 1,
*((unsigned int *)v14 + 5),
v130,
1u,
*((_BYTE *)KeGetCurrentThread() + 562));
}
}
if( P )
ExFreePoolWithTag(P, 0);
if( !v129 && (v164 == (_OBJECT_TYPE *)CmKeyObjectType || v164 == (_OBJECT_TYPE *)IoFileObjectType) )
{
v131 = *((_QWORD *)v14 + 4);
if( v131 )
{
v132 = (_ETHREAD *)KeGetCurrentThread();
LOBYTE(v111) = 1;
v133 = *((_QWORD *)v14 + 6);
--*((_WORD *)v132 + 242);
if( v133 >= v131 )
{
ExAcquireResourceSharedLite(*(PERESOURCE *)(v131 + 48), v111);
v137 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v137 + 242);
v136 = *(struct _ERESOURCE **)(v133 + 48);
}
else
{
ExAcquireResourceSharedLite(*(PERESOURCE *)(v133 + 48), v111);
v135 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v135 + 242);
v136 = *(struct _ERESOURCE **)(v131 + 48);
}
LOBYTE(v134) = 1;
ExAcquireResourceSharedLite(v136, v134);
if( (*(_DWORD *)(v131 + 200) & 0x4000) != 0
&& *(int *)(v131 + 196) >= 2
&& !RtlEqualSid(**(PVOID **)(v133 + 152), **(PVOID **)(v131 + 152))
&& OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO(v67)
&& SepSidInTokenSidHash(
(SID_AND_ATTRIBUTES_HASH *)(v133 + 808),
0i64,
SeConstrainedImpersonationCapabilitySid,
0,
1u,
0) )
{
ObHandleRevocationBlockAddObject((EX_RUNDOWN_REF *)(*(_QWORD *)(v131 + 216) + 128i64), (INT64)Object);
}
ExReleaseResourceLite(*(PERESOURCE *)(v133 + 48));
KeLeaveCriticalRegion();
ExReleaseResourceLite(*(PERESOURCE *)(v131 + 48));
KeLeaveCriticalRegion();
}
}
}
if( a5 && v178 )
*v178 = Object;
v112 = v149;
v138 = v95 | 0xFFFFFFFF80000000ui64;
if( !v149 )
v138 = v95;
*v175 = v138;
v18 = v148 != 0 ? 0x40000000 : 0;
LABEL_286:
if( ThreadCallbackListHead.Flink != &ThreadCallbackListHead )
ObpPostInterceptHandleCreate(Object, v112, (unsigned int)v18, (unsigned int)CurrentAccess, &ThreadCallbackListHead);
if( (xmmword_140CFB490 & 0x40) != 0 && v18 >= 0 )
EtwpTraceHandle(0x1120ui64);
LABEL_291:
v64 = (struct _EX_RUNDOWN_REF *)BugCheckParameter1;
LABEL_292:
if( BYTE4(CurrentAccess) )
ExReleaseRundownProtection(v64 + 139);
return(unsigned int)v18;
}Referenced by:
ObInsertObjectEx
ObOpenObjectByNameEx
ObOpenObjectByPointer