CMFSystemThreadRoutine
VOID __fastcall CMFSystemThreadRoutine(VOID *StartContext){
struct _DMA_ADAPTER *v1;
__int64 *PoolWithTag;
PVOID v3;
int v5;
char *v6;
WCHAR *v7;
UINT32 Length;
int v9;
__int64 *v10;
int v11;
WCHAR v12;
bool v13;
int v14;
ULONG_PTR LowPart;
LARGE_INTEGER *p_MaximumSize;
NTSTATUS v17;
wchar_t *v18;
int v19;
NTSTATUS v20;
struct _DMA_ADAPTER **v21;
struct _KEVENT *v22;
UINT64 ShareAccess;
UINT64 ShareAccessa;
PVOID Buffer;
PVOID Buffera;
UINT64 AllocationType;
UINT64 Win32Protect;
char v29;
union _LARGE_INTEGER MaximumSize;
struct _DMA_ADAPTER *v31;
PVOID BaseAddress;
UNICODE_STRING FileHandle;
void *EventHandle;
void *SectionHandle;
PVOID Object;
ULONG_PTR ViewSize;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
LARGE_INTEGER SectionSize;
struct _IO_STATUS_BLOCK IoStatusBlock;
struct _UNICODE_STRING DestinationString;
__int64 v42;
wchar_t pszDest[264];
SectionSize.QuadPart = 0i64;
MaximumSize.QuadPart = 0i64;
v1 = 0i64;
SectionHandle = 0i64;
PoolWithTag = 0i64;
EventHandle = 0i64;
v3 = 0i64;
*(_QWORD *)&FileHandle.Length = 0i64;
BaseAddress = 0i64;
ViewSize = 0i64;
v42 = 0i64;
v29 = 0;
v31 = 0i64;
Object = 0i64;
IoStatusBlock = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
DestinationString = 0i64;
if( !StartContext )
return;
v5 = *((_DWORD *)StartContext + 12);
if( v5 == 16 )
{
v6 = "RESCDIR";
v7 = L"%s\\rc%04u\\rescache.dir";
LABEL_10:
FileHandle.Buffer = (wchar_t *)v6;
v10 = &v42;
Length = 8;
RtlStringCchPrintfW(pszDest, 0x104ui64, v7);
LABEL_11:
v9 = v11;
if( (v11 & 0xC0000000) == -1073741824 )
{
LABEL_14:
v1 = 0i64;
goto LABEL_61;
}
RtlInitUnicodeString(&DestinationString, pszDest, v12);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v9 = ZwOpenFile(&FileHandle, (PWCHAR)0xC0000000i64);
if( (v9 & 0xC0000000) == -1073741824 )
{
*(_QWORD *)&FileHandle.Length = 0i64;
goto LABEL_14;
}
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 512;
ObjectAttributes.ObjectName = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v9 = ZwCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, SynchronizationEvent, 0);
if( (v9 & 0xC0000000) == -1073741824 )
goto LABEL_14;
v9 = ZwReadFile(
*(HANDLE *)&FileHandle.Length,
EventHandle,
0i64,
0i64,
&IoStatusBlock,
v10,
Length,
&MaximumSize,
0i64);
if( v9 < 0 )
goto LABEL_14;
v9 = ZwWaitForSingleObject(EventHandle, 0, 0i64);
v13 = v9 < 0;
if( v9 )
{
v1 = 0i64;
goto LABEL_19;
}
if( *v10 != *(_QWORD *)FileHandle.Buffer )
{
v9 = -1073700864;
goto LABEL_14;
}
v14 = *((_DWORD *)StartContext + 12);
if( v14 == 32 && *((_DWORD *)PoolWithTag + 19) )
{
*((_DWORD *)StartContext + 6) |= 4u;
v29 = 1;
*((_BYTE *)StartContext + 12) = 1;
}
LowPart = 0i64;
p_MaximumSize = 0i64;
FileHandle.Buffer = *(wchar_t **)&FileHandle.Length;
if( *((_BYTE *)StartContext + 12) )
{
FileHandle.Buffer = 0i64;
MaximumSize.QuadPart = 0i64;
if( v14 == 16 || v14 == 256 )
{
v9 = CMFGetFileSizeEx(*(VOID **)&FileHandle.Length, &MaximumSize);
if( (v9 & 0xC0000000) == -1073741824 )
goto LABEL_14;
LowPart = MaximumSize.LowPart;
v14 = *((_DWORD *)StartContext + 12);
}
else
{
LowPart = *((unsigned int *)PoolWithTag + 8);
MaximumSize.LowPart = *((_DWORD *)PoolWithTag + 8);
}
if( CMFGetLargePageSectionSize(&MaximumSize, &SectionSize) < 0 || *(int *)StartContext >= 0 )
{
*(_DWORD *)StartContext &= ~0x80000000;
p_MaximumSize = &MaximumSize;
ViewSize = LowPart;
}
else
{
p_MaximumSize = &SectionSize;
ViewSize = SectionSize.LowPart;
}
}
if( v14 == 256
|| (v17 = CMFCreateSecurityDescriptor(&Object, 0i64), v3 = Object, v9 = v17, (v17 & 0xC0000000) != -1073741824) )
{
ObjectAttributes.Length = 48;
*(_OWORD *)&ObjectAttributes.RootDirectory = 0ui64;
LODWORD(Buffer) = *(_DWORD *)StartContext;
LODWORD(ShareAccess) = 4;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = (unsigned __int64)v3;
v9 = ZwCreateSection(
&SectionHandle,
6ui64,
&ObjectAttributes,
p_MaximumSize,
ShareAccess,
(UINT64)Buffer,
FileHandle.Buffer);
if( v9 >= 0 )
{
LABEL_43:
Object = 0i64;
v20 = ObReferenceObjectByHandle(SectionHandle, 0xF001Fu, MmSectionObjectType, 0, &Object, 0i64);
v1 = (struct _DMA_ADAPTER *)Object;
v9 = v20;
if( (v20 & 0xC0000000) == -1073741824 )
{
v1 = 0i64;
goto LABEL_61;
}
if( *((_BYTE *)StartContext + 12) )
{
MaximumSize.QuadPart = 0i64;
LODWORD(Win32Protect) = 4;
LODWORD(AllocationType) = 0x400000;
v9 = ZwMapViewOfSection(
SectionHandle,
(PVOID)0xFFFFFFFFFFFFFFFFi64,
&BaseAddress,
0i64,
0i64,
&MaximumSize,
&ViewSize,
ViewUnmap,
AllocationType,
Win32Protect);
if( (v9 & 0xC0000000) == -1073741824 )
{
BaseAddress = 0i64;
goto LABEL_61;
}
if( v29 )
{
*((_DWORD *)PoolWithTag + 19) = 0;
v9 = CMFReadCompressedSegment(*(HANDLE *)&FileHandle.Length, BaseAddress, LowPart, PoolWithTag);
if( v9 < 0 )
goto LABEL_61;
}
else
{
MaximumSize.QuadPart = 0i64;
v9 = ZwReadFile(
*(HANDLE *)&FileHandle.Length,
EventHandle,
0i64,
0i64,
&IoStatusBlock,
BaseAddress,
LowPart,
&MaximumSize,
0i64);
if( v9 < 0 )
goto LABEL_61;
v9 = ZwWaitForSingleObject(EventHandle, 0, 0i64);
v13 = v9 < 0;
if( v9 )
{
LABEL_19:
if( !v13 )
v9 = -1073741823;
goto LABEL_61;
}
}
ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
BaseAddress = 0i64;
}
v21 = (struct _DMA_ADAPTER **)*((_QWORD *)StartContext + 5);
if( v21 )
{
*v21 = v1;
v1 = 0i64;
if( *((_DWORD *)StartContext + 12) == 16 && CMFCacheIndex == 10000 )
{
CMFFlagsCache |= *((_DWORD *)StartContext + 6) & 0xF;
CMFCacheIndex = *((_DWORD *)StartContext + 1);
}
}
goto LABEL_61;
}
v18 = FileHandle.Buffer;
while( *((_BYTE *)StartContext + 12) )
{
v19 = *(_DWORD *)StartContext;
if( *(int *)StartContext >= 0 )
break;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = 0i64;
ObjectAttributes.SecurityQualityOfService = 0i64;
LODWORD(Buffera) = v19 & 0x7FFFFFFF;
LODWORD(ShareAccessa) = 4;
*(_DWORD *)StartContext = v19 & 0x7FFFFFFF;
ViewSize = LowPart;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
ObjectAttributes.SecurityDescriptor = v3;
v9 = ZwCreateSection(&SectionHandle, 6ui64, &ObjectAttributes, &MaximumSize, ShareAccessa, (UINT64)Buffera, v18);
if( v9 >= 0 )
goto LABEL_43;
}
SectionHandle = 0i64;
}
v1 = v31;
goto LABEL_61;
}
if( v5 != 32 )
{
if( v5 != 256 )
{
v9 = -1073741811;
goto LABEL_61;
}
v6 = "RESCHIT";
v7 = (WCHAR *)L"%s\\rc%04u\\rescache.hit";
goto LABEL_10;
}
Length = 4192;
PoolWithTag = (__int64 *)ExAllocatePoolWithTag(PagedPool, 0x1060ui64, 0x636D6650ui64);
if( PoolWithTag )
{
FileHandle.Buffer = (wchar_t *)"RESCSEG";
v10 = PoolWithTag;
RtlStringCchPrintfW(pszDest, 0x104ui64, (WCHAR *)L"%s\\rc%04u\\segment%u.cmf");
goto LABEL_11;
}
v9 = -1073741801;
LABEL_61:
if( EventHandle )
ZwClose(EventHandle);
if( BaseAddress )
ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
if( SectionHandle )
ZwClose(SectionHandle);
if( *(_QWORD *)&FileHandle.Length )
ZwClose(*(HANDLE *)&FileHandle.Length);
if( v3 )
ExFreePoolWithTag(v3, 0);
if( v1 )
HalPutDmaAdapter(v1);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
v22 = (struct _KEVENT *)*((_QWORD *)StartContext + 2);
*((_DWORD *)StartContext + 9) = v9;
if( v22 )
KeSetEvent(v22, 1);
}Referenced by:
No references.