NtAlpcOpenSenderProcess

NTSTATUS __stdcall NtAlpcOpenSenderProcess(
        VOID **ProcessHandle,
        VOID *PortHandle,
        _PORT_MESSAGE *PortMessage,
        UINT64 Flags,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes){
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  NTSTATUS v11; 
  _KALPC_MESSAGE **v12; 
  __int64 v13; 
  _ADAPTER_OBJECT *v14; 
  _KALPC_MESSAGE *v15; 
  _ETHREAD *WaitingThread; 
  _EPROCESS *Process; 
  _ALPC_PORT *OwnerPort; 
  _EX_PUSH_LOCK *p_PortObjectLock; 
  _ADAPTER_OBJECT *v21; 
  PVOID Object; 
  _KALPC_MESSAGE *Message; 
  VOID *v24; 
  PORT_MESSAGE CapturedMessage[4]; 
  UINT64 MessageId[2]; 
  UINT64 CallbackId; 
  _OBJECT_ATTRIBUTES v28; 

  v6 = Flags;
  *(_OWORD *)CapturedMessage = 0i64;
  *(_OWORD *)MessageId = 0i64;
  CallbackId = 0i64;
  v24 = 0i64;
  Message = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  Object = 0i64;
  v11 = ObReferenceObjectByHandle(PortHandle, 0x20000ui64, AlpcPortObjectType, PreviousMode, &Object, 0i64);
  if( v11 < 0 )
    goto LABEL_15;
  if( PreviousMode )
  {
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)ProcessHandle < 0x7FFFFFFF0000i64 )
      v13 = (__int64)ProcessHandle;
    *(_QWORD *)v13 = *(_QWORD *)v13;
    AlpcpProbeAndCaptureMessageHeader((PORT_MESSAGE *)&PortMessage->u1.DataLength, CapturedMessage, v6);
    if( ObjectAttributes < (_OBJECT_ATTRIBUTES *)v12 )
      v12 = (_KALPC_MESSAGE **)ObjectAttributes;
    v28 = *(_OBJECT_ATTRIBUTES *)v12;
  }
  else
  {
    *(_OWORD *)CapturedMessage = *(_OWORD *)&PortMessage->u1.DataLength;
    *($AC85415C5E9358ADF84901D7BAB4BA30 *)MessageId = *($AC85415C5E9358ADF84901D7BAB4BA30 *)((char *)&PortMessage->8 + 8);
    CallbackId = PortMessage->ClientViewSize;
    v28 = *ObjectAttributes;
  }
  v14 = (_ADAPTER_OBJECT *)Object;
  v11 = AlpcpLookupMessage((_ALPC_PORT *)Object, LODWORD(MessageId[1]), (unsigned int)CallbackId, v12);
  if( v11 < 0 )
  {
    HalPutDmaAdapter(v14);
    goto LABEL_15;
  }
  v15 = Message;
  if( (Message->u1.State & 0x80u) != 0 )
  {
    AlpcpUnlockMessage(Message);
    HalPutDmaAdapter(v14);
    v11 = -1073740029;
    goto LABEL_15;
  }
  WaitingThread = Message->WaitingThread;
  if( WaitingThread )
  {
    if( RtlCompareMemory(&WaitingThread->Cid, &CapturedMessage[2], 16) != (_SIZE_T *)16 )
    {
      AlpcpUnlockMessage(v15);
      HalPutDmaAdapter(v14);
      v11 = -1073741813;
      goto LABEL_15;
    }
    Process = WaitingThread->Tcb.Process;
    ObfReferenceObjectWithTag(Process, 0x63706C41ui64);
    goto LABEL_13;
  }
  OwnerPort = Message->OwnerPort;
  if( !OwnerPort )
  {
    AlpcpUnlockMessage(Message);
    v21 = v14;
    goto LABEL_28;
  }
  p_PortObjectLock = &OwnerPort->PortObjectLock;
  ExAcquirePushLockSharedEx(&OwnerPort->PortObjectLock, 0i64);
  if( (OwnerPort->u1.State & 0x40) == 0 )
  {
    Process = OwnerPort->OwnerProcess;
    if( Process->UniqueProcessId == *(void **)&CapturedMessage[2] )
    {
      ObfReferenceObjectWithTag(Process, 0x63706C41ui64);
      if( _InterlockedCompareExchange64(&p_PortObjectLock->_bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(p_PortObjectLock);
      KeAbPostRelease(p_PortObjectLock);
      v15 = Message;
      v14 = (_ADAPTER_OBJECT *)Object;
LABEL_13:
      AlpcpUnlockMessage(v15);
      v11 = PsOpenProcess(&v24, DesiredAccess, (__int64)&v28, &CapturedMessage[2], 0, PreviousMode);
      ObfDereferenceObjectWithTag(Process, 0x63706C41ui64);
      HalPutDmaAdapter(v14);
      if( v11 >= 0 )
        *ProcessHandle = v24;
      goto LABEL_15;
    }
    if( _InterlockedCompareExchange64(&p_PortObjectLock->_bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(p_PortObjectLock);
    KeAbPostRelease(p_PortObjectLock);
    AlpcpUnlockMessage(Message);
    v21 = (_ADAPTER_OBJECT *)Object;
LABEL_28:
    HalPutDmaAdapter(v21);
    v11 = -1073741790;
    goto LABEL_15;
  }
  if( _InterlockedCompareExchange64(&p_PortObjectLock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&OwnerPort->PortObjectLock);
  KeAbPostRelease(&OwnerPort->PortObjectLock);
  AlpcpUnlockMessage(Message);
  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  v11 = -1073741769;
LABEL_15:
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v11;
}

Referenced by: