SPCallServerHandleFileIntegrityQuery
NTSTATUS __stdcall SPCallServerHandleFileIntegrityQuery(INT64 a1, VOID *a2, INT64 a3, INT64 a4){
VOID *v5;
int v6;
unsigned int *v7;
unsigned int *v8;
unsigned int i;
__int64 v10;
unsigned int *v11;
NTSTATUS v12;
VOID **v13;
unsigned int j;
__int64 v15;
unsigned int *v16;
VOID **v17;
VOID **v18;
VOID **v19;
NTSTATUS v20;
_FILE_OBJECT *v21;
int v22;
VOID **PoolWithTag;
VOID **v24;
NTSTATUS v25;
__int64 v26;
_QWORD *v27;
VOID **v28;
NTSTATUS v29;
VOID **v30;
unsigned int v32;
unsigned int *v33;
unsigned int v34;
unsigned int v35;
__int64 v36;
_DWORD *v37;
unsigned int k;
unsigned int v39;
unsigned int v40;
int v41;
unsigned int v42;
POBJECT_HANDLE_INFORMATION HandleInformation;
POBJECT_HANDLE_INFORMATION HandleInformationa;
POBJECT_HANDLE_INFORMATION HandleInformationb;
VOID *v46;
_FILE_OBJECT *FileObject;
VOID *v48;
__int64 Source2;
VOID *v50;
__int64 v51;
PVOID Object;
UINT64 RetOutputBufferSize;
LODWORD(RetOutputBufferSize) = a3;
Object = a2;
v48 = 0i64;
v5 = 0i64;
v6 = 0;
if( !a1 || !a4 )
return -1073741811;
v7 = *(unsigned int **)(a1 + 8);
if( v7 && *(_DWORD *)a1 > 3u )
{
v8 = *(unsigned int **)(a1 + 8);
for( i = 0; i < 3; ++i )
{
v10 = *v8;
v11 = v8 + 1;
if( v8 + 1 < v8 )
goto LABEL_7;
v8 = (unsigned int *)((char *)v11 + v10);
if( (unsigned int *)((char *)v11 + v10) < v11 )
goto LABEL_7;
}
v32 = *v8;
v33 = v8 + 1;
if( v8 + 1 < v8 )
{
LABEL_7:
v12 = -1073741675;
goto LABEL_12;
}
v13 = 0i64;
if( v32 )
v13 = (VOID **)v33;
v12 = 0;
if( v32 != 8 )
return -1073741789;
v48 = *v13;
}
else
{
v12 = -1073741811;
}
LABEL_12:
if( v12 < 0 )
return v12;
if( v7 && *(_DWORD *)a1 > 4u )
{
for( j = 0; j < 4; ++j )
{
v15 = *v7;
v16 = v7 + 1;
if( v7 + 1 < v7 )
goto LABEL_17;
v7 = (unsigned int *)((char *)v16 + v15);
if( (unsigned int *)((char *)v16 + v15) < v16 )
goto LABEL_17;
}
v34 = *v7;
if( v7 + 1 < v7 )
{
LABEL_17:
v12 = -1073741675;
goto LABEL_22;
}
v17 = 0i64;
if( v34 )
v17 = (VOID **)(v7 + 1);
v12 = 0;
if( v34 != 8 )
return -1073741762;
v5 = *v17;
}
else
{
v12 = -1073741811;
}
LABEL_22:
if( v12 < 0 )
return v12;
LODWORD(RetOutputBufferSize) = 0;
v18 = 0i64;
v51 = 0i64;
v19 = 0i64;
v46 = 0i64;
Source2 = 0i64;
if( !v5 )
return -1073741811;
Object = 0i64;
v20 = ObReferenceObjectByHandle(v5, 0i64, (_OBJECT_TYPE *)IoFileObjectType, 1, &Object, 0i64);
v21 = (_FILE_OBJECT *)Object;
v22 = v20;
FileObject = (_FILE_OBJECT *)Object;
if( v20 >= 0 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1Fui64, 542329939i64);
v18 = PoolWithTag;
if( !PoolWithTag )
goto LABEL_81;
*(VOID **)((char *)PoolWithTag + 5) = 0i64;
*(VOID **)((char *)PoolWithTag + 13) = 0i64;
*(VOID **)((char *)PoolWithTag + 21) = 0i64;
*((_BYTE *)PoolWithTag + 30) = 0;
*((_BYTE *)PoolWithTag + 4) = 25;
*(_DWORD *)PoolWithTag = 0;
strcpy((char *)PoolWithTag + 5, "$Kernel.Purge.AppxFICach");
v24 = ExAllocatePoolWithTag(1ui64, 0x3Aui64, 542329939i64);
v19 = v24;
if( !v24 )
{
LABEL_81:
v22 = -1073741801;
goto LABEL_43;
}
*(_OWORD *)v24 = 0i64;
*((_OWORD *)v24 + 1) = 0i64;
*((_OWORD *)v24 + 2) = 0i64;
v24[6] = 0i64;
*((_WORD *)v24 + 28) = 0;
LODWORD(HandleInformation) = 31;
v25 = FsRtlQueryKernelEaFile(v21, v24, 0x3Aui64, 1u, v18, (UINT64)HandleInformation, 0i64, 1u, &RetOutputBufferSize);
v22 = v25;
if( v25 != -1073741275 )
{
if( v25 < 0 )
goto LABEL_43;
v26 = *((unsigned __int16 *)v19 + 3);
v27 = (VOID **)((char *)v19 + *((unsigned __int8 *)v19 + 5) + 9);
if( (char *)v27 + v26 > (char *)v19 + (unsigned int)RetOutputBufferSize )
goto LABEL_83;
if( (_WORD)v26 )
{
if( (_DWORD)v26 == 24 && RtlCompareMemory(v27 + 2, &Source2, 8) == (_SIZE_T *)8 )
{
LODWORD(Object) = 2;
LODWORD(RetOutputBufferSize) = 0;
v28 = ExAllocatePoolWithTag(1ui64, 0x248ui64, 542329939i64);
if( !v28 )
{
v6 = 2;
goto LABEL_43;
}
LODWORD(HandleInformationa) = 584;
v29 = FsRtlKernelFsControlFile(
v21,
0x900F4ui64,
0i64,
0i64,
v28,
(UINT64)HandleInformationa,
&RetOutputBufferSize);
if( v29 < 0 )
goto LABEL_39;
if( (unsigned int)RetOutputBufferSize >= 0x40 )
{
LODWORD(HandleInformationb) = 584;
v50 = *v28;
v29 = FsRtlKernelFsControlFile(
FileObject,
0x900EBui64,
0i64,
0i64,
v28,
(UINT64)HandleInformationb,
&RetOutputBufferSize);
if( v29 < 0 )
{
LABEL_39:
ExFreePoolWithTag(v28, 0x20534C53u);
v6 = (int)Object;
if( v29 >= 0 && v51 == *v27 && v46 == (VOID *)v27[1] )
v6 = 3;
goto LABEL_43;
}
if( (unsigned int)RetOutputBufferSize >= 0x40 )
{
v46 = v28[3];
v51 = (__int64)v50;
goto LABEL_39;
}
}
v29 = -1073741762;
goto LABEL_39;
}
LABEL_83:
v22 = -1073741762;
goto LABEL_43;
}
}
v22 = 0;
}
LABEL_43:
if( FileObject )
HalPutDmaAdapter((PADAPTER_OBJECT)FileObject);
if( v18 )
ExFreePoolWithTag(v18, 0x20534C53u);
if( v19 )
ExFreePoolWithTag(v19, 0x20534C53u);
v12 = v22;
if( v22 >= 0 )
{
*(_DWORD *)(a4 + 4) = 20;
v30 = ExAllocatePoolWithTag(1ui64, 0x14ui64, 542329939i64);
if( !v30 )
return -1073741801;
*(_QWORD *)(a4 + 8) = v30;
*(_DWORD *)a4 = 0;
if( (VOID **)((char *)v30 + 4) < v30 )
return -1073741675;
if( (char *)v30 + 12 > (char *)v30 + *(unsigned int *)(a4 + 4) )
return -1073741789;
*(_DWORD *)v30 = 8;
*(VOID **)((char *)v30 + 4) = v48;
v35 = ++*(_DWORD *)a4;
v36 = *(_QWORD *)(a4 + 8);
if( v36 )
{
v37 = *(_DWORD **)(a4 + 8);
for( k = 0; k < v35; v37 = (_DWORD *)((char *)v37 + v39) )
{
v39 = *v37 + 4;
if( *v37 >= 0xFFFFFFFC || (_DWORD *)((char *)v37 + v39) < v37 )
return -1073741675;
++k;
}
if( v37 + 1 < v37 )
return -1073741675;
v12 = 0;
if( (unsigned __int64)(v37 + 2) <= v36 + (unsigned __int64)*(unsigned int *)(a4 + 4) )
{
*v37 = 4;
v37[1] = v6;
++*(_DWORD *)a4;
return v12;
}
return -1073741789;
}
v40 = *(_DWORD *)(a4 + 4);
v41 = -1;
v42 = v40 + 8;
if( v40 + 8 >= v40 )
v41 = v40 + 8;
v12 = v42 < v40 ? 0xC0000095 : 0;
*(_DWORD *)(a4 + 4) = v41;
if( v42 >= v40 )
{
v12 = 0;
*(_DWORD *)a4 = v35 + 1;
}
}
return v12;
}Referenced by:
sub_1405F50F8