PspAllocateProcess
NTSTATUS __stdcall PspAllocateProcess(
_EPROCESS *Parent,
INT8 PreviousMode,
_OBJECT_ATTRIBUTES *ObjectAttributes,
PS_PROTECTION Protection,
UINT8 SignatureLevel,
UINT8 SectionSignatureLevel,
VOID *SectionObject,
VOID *TokenObject,
UINT64 CreateFlags,
PSP_CREATE_PROCESS_CONTEXT *CreateContext,
UINT64 ExplicitToken,
PSP_ALLOCATE_PROCESS_STATE *AllocateProcessState,
_EPROCESS **NewProcess){
_OBJECT_ATTRIBUTES *v14;
INT64 v16;
unsigned int v17;
NTSTATUS result;
size_t v19;
_BYTE *v20;
INT64 v21;
int v22;
unsigned int v23;
char *v24;
char *v25;
char v26;
int v27;
int v28;
__int64 UniqueProcessId;
char *v30;
unsigned int DefaultHardErrorProcessing;
_EPROCESS *v32;
int v33;
int DefaultPagePriority;
__int64 v35;
int v36;
NTSTATUS InformationToken;
void *v38;
_EWOW64PROCESS *WoW64Process;
VOID *v40;
char v41;
int v42;
INT16 v43;
int v44;
INT16 EquivalentMachineCHPE;
INT64 v46;
unsigned __int16 v47;
PS_CREATE_STATE v48;
VOID **v49;
NTSTATUS v50;
INT64 v51;
INT64 v52;
int v53;
NTSTATUS v54;
INT64 v55;
INT64 v56;
int v57;
VOID **PoolWithTag;
int v59;
VOID **v60;
NTSTATUS v61;
__int16 v62;
_QWORD *v63;
unsigned int v64;
INT8 v65;
__int16 v66;
bool v67;
unsigned __int16 Group;
UINT16 v69;
UINT64 *v70;
volatile signed __int32 *v71;
_EPROCESS *v72;
unsigned int v73;
UINT8 v74;
UINT64 v75;
int v76;
NTSTATUS v77;
UINT64 v78;
_EPROCESS *v79;
_EPROCESS *v80;
PULONG_PTR v81;
PEPROCESS v82;
_EPROCESS *v83;
int v84;
int *v85;
int *v86;
__int64 v87;
unsigned __int8 PriorityClass;
VOID **v89;
UINT64 v90;
NTSTATUS inited;
int v92;
__int16 v93;
int v94;
unsigned int v95;
UINT64 v96;
_EJOB *v97;
_EPROCESS *v98;
INT64 v99;
INT64 v100;
UINT64 v101;
int v102;
int v103;
__int64 v104;
VOID **v105;
PVOID v106;
int v107;
__int64 v108;
__int64 v109;
char IsProtectedProcess;
char IsProtectedProcessLight;
char v112;
_EPROCESS *v113;
__int64 v114;
__int16 v115;
_ETHREAD *v116;
VOID *v117;
int v118;
unsigned int ProcessNtdllType;
_EPROCESS *v120;
ULONGLONG UnbiasedInterruptTime;
_QWORD *v122;
VOID *ParseContext;
VOID *ParseContexta;
VOID *ParseContextb;
VOID *ParseContextc;
VOID *ParseContextd;
VOID *ParseContexte;
VOID *ParseContextf;
VOID *ParseContextg;
UINT64 ObjectBodySize;
UINT64 ObjectBodySizea;
INT64 ObjectBodySizeb;
INT64 ObjectBodySizec;
UINT64 PagedPoolCharge;
UINT64 PagedPoolChargea;
UINT64 NonPagedPoolCharge;
VOID *NonPagedPoolChargea;
VOID **Object;
PSP_ALLOCATE_PROCESS_STATE *v140;
int v142;
UINT8 pbIsAssignable;
CHAR QuantumReset;
UINT8 PackagedApplication;
_EPROCESS *Process;
UINT64 ResultSize;
int Machine;
int v149;
__int16 Buffer;
int v151;
UINT64 ChildProcessPolicy;
_KNODE *IdealNode;
PVOID ObjectPointer;
_OBJECT_ATTRIBUTES *v155;
UINT64 v156;
unsigned int NtdllType;
UINT64 SessionId;
int v159;
int v160;
_EPROCESS *ParentProcess;
PVOID SectionObjecta;
PVOID v163;
__int64 v164;
int v165;
int v166;
int v167;
_DWORD v168[3];
_KPROCESS *v169;
VOID *AccessToken;
_GROUP_AFFINITY GroupAffinity;
__int64 v172;
_ETHREAD *CurrentThread;
UINT64 AffinitySet;
VOID *Handle;
_KNODE *v176;
INT64 v177;
PVOID pSession;
VOID *SystemInformation;
PVOID P;
_QWORD *v181;
VOID *KeyHandle;
_INITIAL_PEB InitialPeb[4];
__int64 v184;
_EPROCESS *v185;
UINT64 v186;
_LARGE_INTEGER *LogicalAddress[3];
_QWORD *v188;
_OBJECT_ATTRIBUTES ObjectAttributesa;
_OBJECT_ATTRIBUTES v190;
INT64 v191[2];
__int64 v192;
UINT64 v193[2];
__int64 v194;
UINT64 MitigationOptionsInheritFrom[2];
__int64 v196;
INT64 v197[2];
__int64 v198;
INT64 v199[2];
__int64 v200;
UINT64 v201[2];
__int64 v202;
UINT64 v203[2];
__int64 v204;
INT64 v205[2];
__int64 v206;
int SectionInformation[20];
UINT64 MitigationOptions[2];
__int64 v209;
INT64 a4[2];
__int64 v211;
_KAPC_STATE ApcState;
INT64 a2[2];
_EPROCESS *NewProcessa[2];
_KAFFINITY_EX Affinity;
int v216[136];
_SYSTEM_INFORMATION_CLASS SystemInformationClass[6];
UINT16 NodeList[20];
_LARGE_INTEGER *v219;
_QWORD *v220;
v14 = ObjectAttributes;
v155 = ObjectAttributes;
Process = Parent;
v185 = Parent;
SectionObjecta = SectionObject;
AccessToken = TokenObject;
v16 = ExplicitToken;
v186 = ExplicitToken;
v177 = (INT64)NewProcess;
LogicalAddress[2] = v219;
v188 = v220;
LODWORD(AffinitySet) = 0;
memset(&ApcState, 0, sizeof(ApcState));
memset(&ObjectAttributesa, 0, sizeof(ObjectAttributesa));
GroupAffinity = 0i64;
KeyHandle = 0i64;
memset(&Affinity, 0i64, sizeof(Affinity));
v17 = 0;
*(_OWORD *)MitigationOptions = 0i64;
v209 = 0i64;
*(_OWORD *)a4 = 0i64;
v211 = 0i64;
PackagedApplication = 0;
memset(&v190, 0, sizeof(v190));
Handle = 0i64;
ObjectPointer = 0i64;
QuantumReset = 0;
Buffer = 0;
LODWORD(ResultSize) = 0;
memset(SectionInformation, 0i64, 0x48u);
LogicalAddress[0] = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
ParentProcess = CurrentThread->Tcb.ApcState.Process;
v176 = 0i64;
IdealNode = 0i64;
P = 0i64;
v166 = 0;
v149 = 0;
v163 = 0i64;
v160 = 0;
v159 = 0;
LOWORD(Machine) = 0;
NtdllType = 0;
ChildProcessPolicy = 0i64;
memset(v168, 0, sizeof(v168));
v156 = 0i64;
v167 = 0;
v184 = 0i64;
memset(v216, 0i64, 0x218u);
v142 = CreateFlags;
if( (CreateFlags & 0x800) != 0 )
{
v17 = 1024;
if( (CreateFlags & 0x2000) != 0 )
{
v17 = 66560;
if( (CreateFlags & 0x4000) != 0 )
v17 = 197632;
}
}
v169 = (_EPROCESS *)((unsigned __int64)Parent & -(__int64)((CreateFlags & 0x100) != 0));
if( ExplicitToken && (*(_DWORD *)(ExplicitToken + 4) & 0x2000) != 0 )
{
if( ((unsigned __int64)Parent & -(__int64)((CreateFlags & 0x100) != 0)) != 0 )
return -1073741776;
v176 = (_KNODE *)KeNodeBlock[*(unsigned __int16 *)(ExplicitToken + 250)];
IdealNode = v176;
v169 = 0i64;
}
else if( Parent )
{
v169 = (_EPROCESS *)((unsigned __int64)Parent & -(__int64)((CreateFlags & 0x100) != 0));
if( (Parent->Flags2 & 0x200000) != 0 )
{
v169 = Parent;
v149 = 0x200000;
}
}
if( ExplicitToken && (*(_DWORD *)(ExplicitToken + 4) & 0x40000) != 0 )
v17 |= 0x1000u;
*(_OWORD *)a2 = 0i64;
*(_OWORD *)NewProcessa = 0i64;
SystemInformation = 0i64;
v19 = 2624;
HIDWORD(ResultSize) = 0;
v164 = 0i64;
if( !PsDisableDiskCounters )
{
v19 = 2664;
v17 |= 0x200u;
v164 = 2624i64;
}
if( PoEnergyEstimationEnabled() )
{
HIDWORD(ResultSize) = (v19 + 7) & 0xFFFFFFF8;
v19 = HIDWORD(ResultSize) + 480;
v17 |= 0x2000u;
v14 = v155;
}
KeQueryMaximumGroupCount(v21, v20);
v22 = (unsigned __int16)v22;
LODWORD(v155) = v22;
v23 = 0;
if( (unsigned __int16)v22 > 1u )
{
v23 = (v19 + 7) & 0xFFFFFFF8;
v19 = 16 * (unsigned __int16)v22 + v23;
}
LODWORD(NonPagedPoolCharge) = v19;
LODWORD(PagedPoolCharge) = 0;
LODWORD(ObjectBodySize) = v19;
result = ObCreateObject(
PreviousMode,
(_OBJECT_TYPE *)PsProcessType,
v14,
PreviousMode,
0i64,
ObjectBodySize,
PagedPoolCharge,
NonPagedPoolCharge,
&ObjectPointer);
if( result >= 0 )
{
v24 = (char *)ObjectPointer;
ObfReferenceObjectWithTag(ObjectPointer, 0x72437350ui64);
ObfDereferenceObjectWithTag(v24, 0x746C6644ui64);
memset(v24, 0i64, v19);
LpcInitializeProcess(v24);
ExInitializePushLock((PULONG_PTR)v24 + 139);
PspInitializeProcessLock((INT64)v24);
*((_QWORD *)v24 + 189) = v24 + 1504;
*((_QWORD *)v24 + 188) = v24 + 1504;
*((_QWORD *)v24 + 277) = v24 + 2208;
*((_QWORD *)v24 + 276) = v24 + 2208;
*((_QWORD *)v24 + 307) = v24 + 2448;
*((_QWORD *)v24 + 306) = v24 + 2448;
v24[2170] = Protection._bf_0;
v24[2168] = SignatureLevel;
v24[2169] = SectionSignatureLevel;
*((_QWORD *)v24 + 283) = 0i64;
*((_QWORD *)v24 + 321) = 0i64;
*((_QWORD *)v24 + 320) = 0i64;
*((_QWORD *)v24 + 323) = 0i64;
*((_QWORD *)v24 + 322) = 0i64;
if( (v17 & 0x400) != 0 )
*((_DWORD *)v24 + 543) |= 1u;
HIDWORD(SessionId) = 32;
if( (v142 & 0x8000) != 0 )
*((_DWORD *)v24 + 543) |= 0x20u;
if( v23 )
{
*((_DWORD *)v24 + 543) |= 0x80u;
v25 = &v24[v23];
*((_QWORD *)v24 + 297) = v25;
*((_QWORD *)v24 + 298) = &v25[8 * (unsigned int)v155];
}
v26 = (char)CreateContext;
if( ((unsigned __int8)CreateContext & 1) != 0 )
*((_DWORD *)v24 + 543) |= 0x1000u;
if( (v26 & 4) != 0 )
*((_DWORD *)v24 + 543) |= 0x800000u;
if( (v26 & 8) != 0 )
*((_DWORD *)v24 + 543) |= 0x8000000u;
v27 = v142;
v28 = 512;
UniqueProcessId = (__int64)ParentProcess->UniqueProcessId | 2;
if( (v142 & 0x200) != 0 )
UniqueProcessId = (__int64)ParentProcess->UniqueProcessId;
*((_QWORD *)v24 + 169) = UniqueProcessId;
if( (v17 & 0x200) != 0 )
*((_QWORD *)v24 + 279) = &v24[v164];
if( (v17 & 0x2000) != 0 )
{
v30 = &v24[HIDWORD(ResultSize)];
*((_QWORD *)v24 + 285) = v30;
PoEnergyContextInitialize(v30);
}
if( v16 && (v28 & *(_DWORD *)(v16 + 4)) != 0 )
{
DefaultHardErrorProcessing = *(_DWORD *)(v16 + 316);
v32 = Process;
}
else
{
v32 = Process;
if( Process )
DefaultHardErrorProcessing = Process->DefaultHardErrorProcessing;
else
DefaultHardErrorProcessing = 5;
}
LogicalAddress[1] = (_LARGE_INTEGER *)(v24 + 1528);
*((_DWORD *)v24 + 382) = DefaultHardErrorProcessing;
*((_DWORD *)v24 + 501) = 259;
if( v32 )
{
v33 = (v32->Flags >> 27) & 7;
DefaultPagePriority = (v32->Flags2 >> 12) & 7;
*((_QWORD *)v24 + 168) = v32->UniqueProcessId;
}
else
{
DefaultPagePriority = MmGetDefaultPagePriority();
}
v155 = (_OBJECT_ATTRIBUTES *)(v24 + 1124);
*((_DWORD *)v24 + 281) = *((_DWORD *)v24 + 281) & 0xC7FFFFFF | (v33 << 27);
v164 = (__int64)(v24 + 1120);
*((_DWORD *)v24 + 280) = (DefaultPagePriority << 12) | *((_DWORD *)v24 + 280) & 0xFFFF8FFF;
if( v177 )
{
if( !PsReferencePartitionSafe(v177) )
{
InformationToken = -1073740640;
LABEL_176:
PspRundownSingleProcess((_EPROCESS *)v24, 0);
ObfDereferenceObjectWithTag(v24, 0x72437350ui64);
LABEL_177:
if( P )
ExFreePoolWithTag(P, 0x73437350u);
SeDeleteCodeIntegrityOriginClaimMembers();
return InformationToken;
}
}
else
{
v177 = PspSystemPartition;
PsReferencePartition(PspSystemPartition);
}
*((_QWORD *)v24 + 315) = v35;
if( !v36 )
{
v163 = SectionObjecta;
if( SectionObjecta )
{
if( (v142 & 0x1000) != 0 )
{
LABEL_57:
InformationToken = -1073741776;
goto LABEL_176;
}
ObfReferenceObject(SectionObjecta);
}
else if( v32 )
{
if( (_DWORD)AllocateProcessState )
goto LABEL_57;
if( PsIsSystemProcess(v32) )
{
InformationToken = -1073741811;
goto LABEL_176;
}
if( ExAcquireRundownProtection(&v32->RundownProtect) )
{
v38 = v32->SectionObject;
SectionObjecta = v38;
if( v38 )
ObfReferenceObject(v38);
ExReleaseRundownProtection(&v32->RundownProtect);
}
if( !SectionObjecta )
{
InformationToken = -1073741558;
goto LABEL_176;
}
WoW64Process = v32->WoW64Process;
if( WoW64Process )
{
v17 |= 0x4000u;
Machine = WoW64Process->Machine;
NtdllType = WoW64Process->NtdllType;
}
if( (v32->Flags & 0x20000) != 0 )
{
v142 |= 8u;
LODWORD(CreateFlags) = v27 | 8;
}
}
}
v181 = v24 + 1304;
v40 = SectionObjecta;
*((_QWORD *)v24 + 163) = SectionObjecta;
WORD2(ResultSize) = 0;
if( v16 )
{
*((_QWORD *)v24 + 270) = *(_QWORD *)(v16 + 464);
InformationToken = MmGetSectionInformation(v40, MaxSectionInfoClass, (VOID *)(v16 + 48));
if( InformationToken < 0 )
goto LABEL_176;
v41 = *(_BYTE *)(v16 + 99);
v42 = v17 | (32
* (v41 & 4 | (4
* (v41 & 2 | ((*(_DWORD *)(v16 + 112) & 1 | (2
* (*(_DWORD *)(v16 + 112) & 2 | (2 * (*(_DWORD *)(v16 + 112) & 0xF8))))) << 11)))));
v160 = *(unsigned __int16 *)(v16 + 86);
v159 = *(unsigned __int16 *)(v16 + 84);
v43 = *(_WORD *)(v16 + 96);
if( (v42 & 0x100) != 0 && v43 == 332 && (v41 & 1) != 0 )
v44 = 0x8000;
else
v44 = 0;
v17 = v44 | v42;
EquivalentMachineCHPE = RtlWow64GetEquivalentMachineCHPE(v43);
v47 = EquivalentMachineCHPE;
if( (*(_WORD *)(v16 + 92) & *(_WORD *)(v16 + 10)) != 0 )
{
v48 = PsCreateFailExeFormat;
LABEL_82:
InformationToken = -1073741701;
LABEL_83:
PspUpdateCreateInfo(v48, (PSP_CREATE_PROCESS_CONTEXT *)v16, 0i64);
goto LABEL_176;
}
if( (v17 & 0x8000) == 0 )
{
if( PsWow64IsMachineSupported(EquivalentMachineCHPE) )
{
v17 |= 0x4000u;
LOWORD(Machine) = v47;
}
if( (v17 & 0x8000) == 0
&& (v47 < KUSER_SHARED_DATA.ImageNumberLow || v47 > KUSER_SHARED_DATA.ImageNumberHigh)
&& (v17 & 0x4000) == 0 )
{
v48 = PsCreateFailMachineMismatch;
goto LABEL_82;
}
}
if( v163 )
{
WORD2(ResultSize) = *(_WORD *)(v16 + 94);
v49 = (VOID **)(v16 + 192);
v50 = RtlOpenImageFileOptionsKey(
(const _UNICODE_STRING *)(v16 + 232),
0i64,
(VOID **)(v16 + 192),
v46,
(INT64)ParseContext,
ObjectBodySizea,
PagedPoolChargea,
(INT64)NonPagedPoolChargea);
if( v50 < 0 )
{
if( v50 == -1073741772 )
*(_BYTE *)(v16 + 8) |= 0x40u;
*v49 = 0i64;
}
ObfReferenceObjectWithTag(*(VOID **)(v16 + 176), 0x72437350ui64);
*((_QWORD *)v24 + 180) = *(_QWORD *)(v16 + 176);
if( (v17 & 0x4000) != 0 )
{
v53 = v142;
}
else
{
InformationToken = PspDetectComplusILImage(
(PSP_CREATE_PROCESS_CONTEXT *)v16,
&CreateFlags,
v51,
v52,
(INT64)ParseContexta,
ObjectBodySizea,
PagedPoolChargea,
(INT64)NonPagedPoolChargea);
if( InformationToken < 0 )
goto LABEL_176;
v53 = CreateFlags;
LOWORD(v142) = CreateFlags;
if( v47 == 332 && (CreateFlags & 8) == 0 )
{
if( PsWow64IsMachineSupported(332) )
{
Machine = 332;
LABEL_105:
v17 |= 0x4000u;
goto LABEL_108;
}
if( PsWow64IsMachineSupported(452) )
{
LOWORD(Machine) = 452;
goto LABEL_105;
}
v53 |= 8u;
LOWORD(v142) = v53;
LODWORD(CreateFlags) = v53;
}
}
LABEL_108:
if( *v49 )
{
if( *(char *)(v16 + 8) >= 0 )
{
LODWORD(ParseContexta) = 2;
v54 = RtlQueryImageFileKeyOption(
*v49,
(WCHAR *)L"Debugger",
1ui64,
&Buffer,
(UINT64)ParseContexta,
&ResultSize);
if( v54 == -2147483643 || v54 >= 0 && (_DWORD)ResultSize == 2 && Buffer )
{
InformationToken = -1073741767;
v48 = PsCreateFailExeName;
goto LABEL_83;
}
}
v151 = 0;
LODWORD(ParseContexta) = 4;
if( RtlQueryImageFileKeyOption(*v49, (WCHAR *)L"UseLargePages", 4ui64, &v151, (UINT64)ParseContexta, 0i64) >= 0 )
{
if( v151 )
{
v53 |= 0x10u;
LOWORD(v142) = v53;
LODWORD(CreateFlags) = v53;
if( (v17 & 0x4000) == 0 )
{
ObjectAttributesa.Length = 48;
ObjectAttributesa.RootDirectory = *v49;
ObjectAttributesa.Attributes = 576;
ObjectAttributesa.ObjectName = (_UNICODE_STRING *)&PspLargePageDLLKeyName;
*(_OWORD *)&ObjectAttributesa.SecurityDescriptor = 0i64;
if( ZwOpenKey(
&KeyHandle,
1ui64,
&ObjectAttributesa,
v55,
(INT64)ParseContextb,
ObjectBodySizeb,
PagedPoolChargea,
(INT64)NonPagedPoolChargea) >= 0 )
{
v151 = 0;
LODWORD(ParseContextb) = 4;
if( RtlQueryImageFileKeyOption(
KeyHandle,
(WCHAR *)L"ntdll.dll",
4ui64,
&v151,
(UINT64)ParseContextb,
0i64) >= 0
&& v151 )
{
v53 |= 0x20u;
LOWORD(v142) = v53;
LODWORD(CreateFlags) = v53;
}
ObCloseHandle(KeyHandle, 0);
}
}
}
}
if( !v169 )
{
PspReadIFEONodeOptions((_EPROCESS *)v24, (VOID **)*v49, &IdealNode);
v176 = IdealNode;
}
v165 = 0;
LODWORD(ParseContextb) = 4;
if( RtlQueryImageFileKeyOption(*v49, (WCHAR *)L"ForceWakeCharge", 4ui64, &v165, (UINT64)ParseContextb, 0i64) >= 0
&& v165 )
{
v149 |= 0x40u;
}
LODWORD(ParseContextc) = 0;
if( RtlQueryImageFileKeyOption(
*v49,
(WCHAR *)L"AllowedCpuSets",
3ui64,
0i64,
(UINT64)ParseContextc,
&ResultSize) == -2147483643 )
{
v57 = ResultSize;
if( (unsigned int)ResultSize <= 0xA0 && (ResultSize & 7) == 0 )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)ResultSize, 1933800272i64);
P = PoolWithTag;
if( !PoolWithTag )
{
LABEL_132:
InformationToken = -1073741801;
goto LABEL_176;
}
LODWORD(ParseContextd) = v57;
if( RtlQueryImageFileKeyOption(
*v49,
(WCHAR *)L"AllowedCpuSets",
3ui64,
PoolWithTag,
(UINT64)ParseContextd,
&ResultSize) >= 0
&& (ResultSize & 7) == 0 )
{
v17 |= 0x200000u;
HIDWORD(ChildProcessPolicy) = (unsigned int)ResultSize >> 3;
}
}
}
v190.Length = 48;
v190.RootDirectory = *v49;
v190.Attributes = 576;
v190.ObjectName = (_UNICODE_STRING *)&PspPerfOptionsKeyName;
*(_OWORD *)&v190.SecurityDescriptor = 0i64;
if( ZwOpenKey(
&Handle,
1ui64,
&v190,
v56,
(INT64)ParseContextd,
ObjectBodySizec,
PagedPoolChargea,
(INT64)NonPagedPoolChargea) >= 0 )
{
PspReadIFEOPerfOptions(Handle, (INT64)a2);
ObCloseHandle(Handle, 0);
}
}
LABEL_143:
v59 = v166 | 0x20000;
if( (v53 & 8) == 0 )
v59 = v166;
if( (v17 & 0x4000) != 0 )
{
v60 = ExAllocatePoolWithTag(0x200ui64, 0x10ui64, 1350004567i64);
*((_QWORD *)v24 + 176) = v60;
if( !v60 )
goto LABEL_132;
v61 = NtdllType;
v62 = Machine;
if( !NtdllType )
v61 = PspWow64PickBestNtdll(v16);
*((_WORD *)v60 + 4) = v62;
*(_DWORD *)(*((_QWORD *)v24 + 176) + 12i64) = v61;
v63 = (_QWORD *)*((_QWORD *)v24 + 176);
if( v63 )
*v63 = 1i64;
}
InformationToken = SeQueryInformationToken(AccessToken, TokenIsAppContainer, (VOID **)((char *)&v156 + 4));
if( InformationToken < 0 )
goto LABEL_176;
v64 = 0;
v65 = PreviousMode;
if( PreviousMode )
{
if( v16 && (*(_DWORD *)(v16 + 4) & 0x100) != 0 && *(_BYTE *)(v16 + 248) == 4 )
{
SystemInformationClass[0] = SystemPagedPoolInformation;
v64 = 1;
}
if( (_DWORD)AllocateProcessState )
SystemInformationClass[v64++] = SystemTimeOfDayInformation;
v66 = v142;
if( (v142 & 0x30) != 0 )
SystemInformationClass[v64++] = SystemPathInformation;
if( (v142 & 0x80u) != 0 && !MmIsSessionLeaderProcess(ParentProcess) )
SystemInformationClass[v64++] = SystemCallTimeInformation;
if( (v142 & 0x8400) != 0 )
SystemInformationClass[v64++] = SystemDeviceInformation;
if( v64 )
{
v67 = RtlAcquirePrivilege(
(UINT64 *)SystemInformationClass,
v64,
(_DWORD)AllocateProcessState != 0,
&SystemInformation) < 0;
v65 = PreviousMode;
if( !v67 )
v17 |= 0x10u;
}
else
{
v65 = PreviousMode;
}
}
else
{
v66 = v142;
}
if( (v66 & 0x8400) != 0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v65) )
goto LABEL_173;
if( v169 )
{
KeQueryAffinityProcess(&v169->Pcb, &Affinity, 0i64, NodeList);
KeFirstGroupAffinityEx(&GroupAffinity, (UINT8)&Affinity, v69, v70);
IdealNode = (_KNODE *)KeNodeBlock[NodeList[GroupAffinity.Group]];
}
else
{
if( v176 )
{
Group = v176->Affinity.Group;
}
else if( Process )
{
if( (Process->Flags2 & 0x100000) != 0 )
{
v149 |= 0x100000u;
IdealNode = (_KNODE *)KeNodeBlock[Process->Pcb.IdealGlobalNode];
Group = IdealNode->Affinity.Group;
}
else
{
IdealNode = PspSelectNodeForProcess((INT64)Process);
Group = IdealNode->Affinity.Group;
if( KeForceGroupAwareness && KeQueryActiveGroupCount() > 1u && !Group )
{
IdealNode = 0i64;
Group = 1;
}
}
}
else
{
Group = 0;
}
GroupAffinity.Group = Group;
GroupAffinity.Mask = KeActiveProcessors.Bitmap[Group];
if( !IdealNode )
IdealNode = KeSelectNodeForAffinity(&GroupAffinity);
LOBYTE(v142) = CreateFlags;
v24 = (char *)ObjectPointer;
}
v71 = (volatile signed __int32 *)v155;
v155->Length |= v59;
*(_DWORD *)v164 |= v149;
v72 = Process;
if( Process )
{
pSession = 0i64;
v73 = 0;
LODWORD(SessionId) = 0;
v74 = 0;
pbIsAssignable = 0;
if( (_DWORD)AllocateProcessState )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeAssignPrimaryTokenPrivilege, PreviousMode) )
v17 |= 4u;
InformationToken = SeIsTokenAssignableToProcess(AccessToken, &pbIsAssignable, v75);
if( InformationToken < 0 )
goto LABEL_174;
v76 = (v17 >> 2) & 1;
v74 = pbIsAssignable;
if( !pbIsAssignable && !v76 )
goto LABEL_173;
InformationToken = SeQuerySessionIdToken(AccessToken, &SessionId);
if( InformationToken < 0 )
goto LABEL_174;
v77 = MmGetSessionIdEx(ParentProcess);
v73 = SessionId;
if( (_DWORD)SessionId != v77 )
{
if( !v76 )
{
LABEL_173:
InformationToken = -1073741727;
goto LABEL_174;
}
if( (v142 & 0x80u) != 0 )
{
InformationToken = -1073741811;
goto LABEL_174;
}
v17 |= 1u;
}
}
else if( !v163 )
{
v73 = MmGetSessionIdEx(Process);
LODWORD(SessionId) = v73;
v17 |= v73 != MmGetSessionIdEx(ParentProcess);
}
if( (v17 & 1) != 0 )
{
InformationToken = PspAttachSession(v73, &ApcState, &pSession);
if( InformationToken < 0 )
{
LOBYTE(v17) = v17 & 0xFE;
goto LABEL_174;
}
*(_DWORD *)v164 |= 0x80u;
}
if( !(_DWORD)AllocateProcessState || v74 )
{
v79 = Process;
if( v74 )
v79 = ParentProcess;
PspInheritQuota((_EPROCESS *)v24, v79);
}
else
{
InformationToken = PspAssignProcessQuotaBlock(0i64, (_EPROCESS *)v24, AccessToken);
if( InformationToken < 0 )
{
if( (v17 & 1) != 0 )
PspDetachSession((PADAPTER_OBJECT)pSession);
goto LABEL_174;
}
}
v80 = (_EPROCESS *)PspMaximumWorkingSet;
if( (a2[0] & 0x100000000i64) != 0 )
v80 = NewProcessa[1];
HIDWORD(ObjectBodySizea) = HIDWORD(v24);
v17 |= 32 * (MmCreateProcessAddressSpace(v177, v78, v80) & 1);
if( (v17 & 1) != 0 )
PspDetachSession((PADAPTER_OBJECT)pSession);
if( (v17 & 0x20) == 0 )
goto LABEL_228;
v72 = Process;
v71 = (volatile signed __int32 *)v155;
}
else
{
PspInheritQuota((_EPROCESS *)v24, 0i64);
v24[912] = 1;
InformationToken = MmInitializeHandBuiltProcess(v82, v81);
if( InformationToken < 0 )
goto LABEL_174;
}
NtdllType = v17;
_InterlockedOr(v71, 0x40000u);
v24 = (char *)ObjectPointer;
HIDWORD(ParseContexte) = (unsigned __int64)MmGetSessionSchedulingGroupByProcess((_EPROCESS *)ObjectPointer) >> 32;
KeInitializeProcess(v83, 8i64, &GroupAffinity, IdealNode);
InformationToken = v84;
if( v84 < 0 )
goto LABEL_174;
if( v16 )
{
LODWORD(ChildProcessPolicy) = *(_DWORD *)(v16 + 416);
v168[0] = *(_DWORD *)(v16 + 420);
*(_QWORD *)&v168[1] = *(_QWORD *)(v16 + 440);
v167 = *(_DWORD *)(v16 + 448);
v184 = *(_QWORD *)(v16 + 208);
v85 = *(int **)(v16 + 424);
LODWORD(v156) = *(_DWORD *)(v16 + 432);
if( *(_QWORD *)(v16 + 176) && SeGetCodeIntegrityOriginClaimForFileObject() >= 0 )
{
if( !v216[0] && v85 && (_DWORD)v156 == 524 )
{
v86 = v216;
v87 = 4i64;
do
{
*(_OWORD *)v86 = *(_OWORD *)v85;
*((_OWORD *)v86 + 1) = *((_OWORD *)v85 + 1);
*((_OWORD *)v86 + 2) = *((_OWORD *)v85 + 2);
*((_OWORD *)v86 + 3) = *((_OWORD *)v85 + 3);
*((_OWORD *)v86 + 4) = *((_OWORD *)v85 + 4);
*((_OWORD *)v86 + 5) = *((_OWORD *)v85 + 5);
*((_OWORD *)v86 + 6) = *((_OWORD *)v85 + 6);
v86 += 32;
*((_OWORD *)v86 - 1) = *((_OWORD *)v85 + 7);
v85 += 32;
--v87;
}
while( v87 );
*(_QWORD *)v86 = *(_QWORD *)v85;
v86[2] = v85[2];
}
v85 = v216;
LODWORD(v156) = 536;
}
}
else
{
v85 = 0i64;
}
LODWORD(v140) = v156;
LODWORD(NonPagedPoolChargea) = v168[0];
LODWORD(PagedPoolChargea) = (v17 >> 12) & 1;
LODWORD(ObjectBodySizea) = (v17 >> 11) & 1;
LODWORD(ParseContexte) = ChildProcessPolicy;
InformationToken = PspInitializeProcessSecurity(
v72,
(_EPROCESS *)v24,
AccessToken,
(unsigned int)AllocateProcessState,
(UINT64)ParseContexte,
ObjectBodySizea,
PagedPoolChargea,
NonPagedPoolChargea,
(UINT64)v85,
v140);
if( InformationToken < 0 )
goto LABEL_174;
v24[1463] = 2;
if( v72 )
{
PriorityClass = v24[1463];
if( ((v72->PriorityClass - 1) & 0xFB) == 0 )
PriorityClass = v72->PriorityClass;
v24[1463] = PriorityClass;
v89 = v16 ? *(VOID ***)(v16 + 296) : 0i64;
v90 = v16 ? *(unsigned int *)(v16 + 292) : 0i64;
inited = ObInitProcess(
(_EX_RUNDOWN_REF *)((unsigned __int64)v72 & -(__int64)((CreateFlags & 4) != 0)),
(ULONG_PTR)v24,
v90,
v89);
}
else
{
*((_QWORD *)v24 + 174) = ParentProcess->ObjectTable;
MmInitializeHandBuiltProcess2((_EPROCESS *)v24);
}
InformationToken = inited;
if( inited < 0 )
goto LABEL_174;
if( (a2[0] & 7) != 0 )
PspApplyIFEOPerfOptions((_EPROCESS *)v24, (UINT64 *)a2, PreviousMode);
if( (v17 & 0x200000) != 0 )
KeSetCpuSetsProcess((_EPROCESS *)v24, HIDWORD(ChildProcessPolicy), (UINT64 *)P, 1ui64);
if( v16 )
{
if( (*(_DWORD *)(v16 + 4) & 0x100) != 0 )
{
InformationToken = PspSetProcessPriorityClass((_EPROCESS *)v24, *(_BYTE *)(v16 + 248), 0i64, PreviousMode);
if( InformationToken < 0 )
goto LABEL_174;
}
}
v24[640] = PspComputeQuantumAndPriority(
(_EPROCESS *)v24,
PsProcessPriorityBackground,
&QuantumReset,
0i64,
0i64);
v24[641] = QuantumReset;
InformationToken = 0;
LODWORD(ChildProcessPolicy) = 0;
PspReadIFEOMitigationOptions((_PSP_CREATE_PROCESS_CONTEXT *)v16, MitigationOptions);
*(_OWORD *)v193 = *(_OWORD *)MitigationOptions;
v194 = v209;
*(_OWORD *)MitigationOptionsInheritFrom = PspSystemMitigationOptions;
v196 = qword_140CFB9E0;
PspInheritMitigationOptions((UINT64)MitigationOptionsInheritFrom, (UINT64)v193);
PspReadIFEOMitigationAuditOptions(v16, (INT64)a4);
*(_OWORD *)v197 = *(_OWORD *)a4;
v198 = v211;
*(_OWORD *)v199 = PspSystemMitigationAuditOptions;
v200 = qword_140CFBB80;
PspInheritMitigationAuditOptions((INT64)v199, (INT64)v197, (INT64)a4);
v92 = (HIWORD(MitigationOptions[0]) & 3) << 16;
if( v16 )
{
if( (*(_DWORD *)(v16 + 4) & 0x10000) != 0 )
{
*(_OWORD *)v201 = *(_OWORD *)(v16 + 360);
v202 = *(_QWORD *)(v16 + 376);
*(_OWORD *)v203 = *(_OWORD *)MitigationOptions;
v204 = v209;
PspInheritMitigationOptions((UINT64)v203, (UINT64)v201);
}
if( (*(_DWORD *)(v16 + 4) & 0x8000000) != 0 )
{
*(_OWORD *)v191 = *(_OWORD *)(v16 + 488);
v192 = *(_QWORD *)(v16 + 504);
*(_OWORD *)v205 = *(_OWORD *)a4;
v206 = v211;
PspInheritMitigationAuditOptions((INT64)v205, (INT64)v191, (INT64)a4);
}
}
if( HIDWORD(v156) )
LOWORD(v92) = v92 | 4;
v93 = v92 | 0x100;
if( (v92 & 4) == 0 )
v93 = v92;
if( (v93 & 0xFF00) != 0 )
PspHardenMitigationOptions(MitigationOptions);
if( !KeIsUserCetAllowed() )
MitigationOptions[1] = MitigationOptions[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x2000000000000000i64;
if( (ResultSize & 0x400000000000i64) == 0 || (v17 & 0x40000) == 0 )
HIDWORD(SessionId) = 0;
v95 = v94 | ((ResultSize & 0x400000000000i64) != 0 ? 8 : 0) | (WORD2(ResultSize) >> 4) & 2 | ((v17 & 0x180) != 0) | HIDWORD(SessionId) | ((v17 & 0x100000 | (v17 >> 1) & 0x7C00000) >> 2);
LODWORD(v155) = v17 & 0x400;
if( (v17 & 0x400) != 0 )
{
MitigationOptions[1] = MitigationOptions[1] & 0xCFFFFFFFFFFFFFFCui64 | 0x2000000000000002i64;
if( ((unsigned __int8)CreateContext & 2) != 0 )
v96 = MitigationOptions[0] & 0xFFFFFCFFFFCCFFFFui64 | 0x20000220000i64;
else
v96 = MitigationOptions[0] & 0xFFFFFCFFFFCCFFFFui64 | 0x20000110000i64;
MitigationOptions[0] = v96;
}
if( !v163 && Process && (Process->MitigationFlags2 & 0x4000) == 0 )
MitigationOptions[1] = MitigationOptions[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x2000000000000000i64;
LODWORD(v97) = PsGetProcessServerSilo((INT64)v24);
if( !PsIsHostSilo(v97) )
MitigationOptions[1] = MitigationOptions[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x2000000000000000i64;
if( (v17 & 0x4000) != 0 )
MitigationOptions[1] = MitigationOptions[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x2000000000000000i64;
LODWORD(ParseContextf) = v95;
v98 = Process;
PspApplyMitigationOptions(
(_EPROCESS *)v24,
(INT64)Process,
(__m128i *)MitigationOptions,
(INT64)a4,
(INT64)ParseContextf);
if( v16 )
{
PspApplyWin32kFilterOptions((_EPROCESS *)v24, (_PSP_CREATE_PROCESS_CONTEXT *)v16);
PspApplyComponentFilterOptions(v100, v99);
*(_OWORD *)(v16 + 360) = *(_OWORD *)MitigationOptions;
*(_QWORD *)(v16 + 376) = v209;
*(_OWORD *)(v16 + 488) = *(_OWORD *)a4;
*(_QWORD *)(v16 + 504) = v211;
}
PsQueryProcessAttributes((_EPROCESS *)v24, 0i64, &PackagedApplication);
v101 = (HIDWORD(v156) != 0) | 2u;
if( (CreateFlags & 0x20000) == 0 )
v101 = HIDWORD(v156) != 0;
SmProcessCreateNotification((_EPROCESS *)v24, v101);
if( v98 && v98 != PsInitialSystemProcess && (v98->Flags3 & 0x2000000) != 0 )
*((_DWORD *)v24 + 543) |= 0x2000000u;
if( (CreateFlags & 0x80u) != 0i64
&& !MmIsSessionLeaderProcess(ParentProcess)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeLoadDriverPrivilege, PreviousMode) )
{
goto LABEL_173;
}
v102 = (int)v155;
if( (_DWORD)v155 || v163 )
{
InformationToken = PspInitializeFullProcessImageName((PSP_CREATE_PROCESS_CONTEXT *)v16, (_EPROCESS *)v24);
if( InformationToken >= 0 )
{
if( (v17 & 0x10000) != 0 )
{
LODWORD(ParseContextg) = (v17 >> 17) & 1;
MmInitializeProcessAddressSpace((_EPROCESS *)v24, v98, 0i64, &CreateFlags, (UINT64)ParseContextg);
v106 = SectionObjecta;
}
else
{
LODWORD(ParseContextg) = 0;
v106 = SectionObjecta;
MmInitializeProcessAddressSpace(
(_EPROCESS *)v24,
0i64,
SectionObjecta,
&CreateFlags,
(UINT64)ParseContextg);
}
InformationToken = v107;
if( v107 >= 0 )
{
if( v16 )
{
LODWORD(v108) = MmGetImageSectionBasedAddress((INT64)v106);
v109 = *((_QWORD *)v24 + 164);
if( v108 != v109 )
*(_QWORD *)(v16 + 48) += v109 - v108;
}
LODWORD(ChildProcessPolicy) = InformationToken;
if( !v102 )
LOWORD(v17) = v17 | 2;
LOWORD(v17) = (4 * (CreateFlags & 0x10 | 2)) | v17;
goto LABEL_321;
}
}
}
else
{
if( !v98 )
goto LABEL_321;
*((_QWORD *)v24 + 164) = v98->SectionBaseAddress;
LODWORD(ParseContextg) = (v17 >> 11) & 1;
MmInitializeProcessAddressSpace((_EPROCESS *)v24, v98, 0i64, &CreateFlags, (UINT64)ParseContextg);
InformationToken = v103;
if( v103 >= 0 )
{
LOWORD(v17) = NtdllType | (4 * (CreateFlags & 0x10)) | 2;
v104 = *((unsigned __int16 *)v98->SeAuditProcessCreationInfo.ImageFileName + 1);
v105 = ExAllocatePoolWithTag(0x200ui64, v104 + 16, 1632658771i64);
*((_QWORD *)v24 + 184) = v105;
if( !v105 )
{
LABEL_228:
InformationToken = -1073741670;
goto LABEL_174;
}
memmove(v105, v98->SeAuditProcessCreationInfo.ImageFileName, v104 + 16);
*(_QWORD *)(*((_QWORD *)v24 + 184) + 8i64) = *((_QWORD *)v24 + 184) + 16i64;
*((_DWORD *)v24 + 330) = v98->Cookie;
if( (CreateFlags & 0x1000) != 0 )
{
*v181 = 0i64;
HalPutDmaAdapter((PADAPTER_OBJECT)SectionObjecta);
}
LABEL_321:
if( (v17 & 0x10) != 0 )
RtlReleasePrivilege(SystemInformation);
if( (unsigned __int16)PsWow64GetProcessMachine((INT64)v24) == 332 )
*((_DWORD *)v24 + 158) |= 1u;
HIDWORD(ChildProcessPolicy) = v17 & 8;
if( (v17 & 8) != 0 )
{
if( v16 )
{
InformationToken = PspSetupReservedUserMappings(
(ULONG_PTR)v24,
&ApcState,
(PSP_CREATE_PROCESS_CONTEXT *)v16);
if( InformationToken < 0 )
goto LABEL_176;
}
}
LODWORD(v155) = v17 & 2;
if( (v17 & 2) != 0 )
{
*(_QWORD *)InitialPeb = 0i64;
*(_QWORD *)&InitialPeb[2] = -1i64;
IsProtectedProcess = PsIsProtectedProcess((_EPROCESS *)v24);
IsProtectedProcessLight = PsIsProtectedProcessLight((_EPROCESS *)v24);
v112 = HIBYTE(InitialPeb[0]) & 0x88 | ((v17 & 0x40) != 0) | (2
* (IsProtectedProcess & 1 | (2 * ((16 * (IsProtectedProcessLight & 1)) | ((v17 & 0x80) != 0))))) & 0xCF | (16 * ((HIDWORD(v156) != 0 ? 2 : 0) | PackagedApplication & 1));
HIBYTE(InitialPeb[0]) = v112;
if( v163 )
{
InformationToken = MmCreatePeb((_EPROCESS *)v24, InitialPeb, (PEB **)v24 + 170, &GroupAffinity);
if( InformationToken < 0 )
{
*((_QWORD *)v24 + 170) = 0i64;
goto LABEL_176;
}
if( GroupAffinity.Mask )
{
_InterlockedAnd((volatile signed __int32 *)v164, 0xFFCFFFFF);
v24 = (char *)ObjectPointer;
PspSetProcessAffinitySafe((_EPROCESS *)ObjectPointer, 1ui64, 0i64, &GroupAffinity, &AffinitySet);
}
}
else
{
v113 = Process;
*(_QWORD *)&v168[1] = Process->Peb;
*((_QWORD *)v24 + 170) = *(_QWORD *)&v168[1];
if( (v17 & 0x800) != 0 )
{
LABEL_347:
if( (v17 & 8) != 0 && v16 )
{
InformationToken = PspSetupUserProcessAddressSpace(
v113,
(_EPROCESS *)v24,
&ApcState,
(PSP_CREATE_PROCESS_CONTEXT *)v16);
}
else if( (_DWORD)v155 && (v17 & 0x800) == 0 )
{
InformationToken = 0;
KeStackAttachProcess((PRKPROCESS)v24, &ApcState);
v116 = CurrentThread;
PspWritePebAffinityInfo(CurrentThread, (_EX_RUNDOWN_REF *)v24);
if( (v17 & 8) != 0 )
{
MmMapApiSetView((_EPROCESS *)v24);
InformationToken = v118;
if( v118 >= 0 )
{
InformationToken = PspMapSiloSharedDataView((_EPROCESS *)v24);
if( InformationToken >= 0 )
{
InformationToken = PspPrepareSystemDllInitBlock(0i64);
if( InformationToken >= 0 )
{
if( *((_QWORD *)v24 + 176) )
{
ProcessNtdllType = PsWow64GetProcessNtdllType((INT64)v24);
InformationToken = PspPrepareSystemDllInitBlock((PSP_CREATE_PROCESS_CONTEXT *)ProcessNtdllType);
}
}
}
}
}
KeUnstackDetachProcess(&ApcState);
LABEL_351:
MmNewProcessInitialized((INT64)v24);
if( InformationToken < 0 )
goto LABEL_176;
PspLockProcessExclusive((_EPROCESS *)v24, v116);
v117 = ExCreateHandle(PspCidTable, v24);
*((_QWORD *)v24 + 136) = v117;
if( !v117 )
{
PspUnlockProcessExclusive((_EPROCESS *)v24, v116);
InformationToken = -1073741670;
goto LABEL_176;
}
if( (v17 & 0x1000) != 0 )
{
InformationToken = MmGetSectionStrongImageReference(
0i64,
0,
*((_SECTION **)v24 + 163),
(unsigned __int64 *)LogicalAddress);
v120 = (_EPROCESS *)v24;
if( InformationToken < 0 )
{
LABEL_365:
PspUnlockProcessExclusive(v120, v116);
goto LABEL_176;
}
InformationToken = KeSecureProcess(
(_DMA_ADAPTER *)v24,
**(VOID ***)(v16 + 392),
*((_LARGE_INTEGER **)v24 + 170),
*((_MEMORY_CACHING_TYPE **)v24 + 136),
LogicalAddress[0],
*((VOID ***)v24 + 164),
*(_QWORD *)(v16 + 392),
(_LARGE_INTEGER *)*(unsigned int *)(v16 + 408),
Object);
if( InformationToken < 0 )
{
v120 = (_EPROCESS *)v24;
goto LABEL_365;
}
}
if( KeQuerySystemTimeUnsafe() )
{
KeQuerySystemTimePrecise((_LARGE_INTEGER *)v24 + 141);
}
else
{
v24 = (char *)ObjectPointer;
*((_QWORD *)ObjectPointer + 141) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
}
*((_QWORD *)v24 + 288) = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
UnbiasedInterruptTime = KeQueryUnbiasedInterruptTime();
v122 = ObjectPointer;
*((_QWORD *)ObjectPointer + 289) = UnbiasedInterruptTime;
v122[291] = *((_QWORD *)v24 + 288);
*v188 = v122;
InformationToken = ChildProcessPolicy;
goto LABEL_177;
}
v116 = CurrentThread;
goto LABEL_351;
}
LOBYTE(InitialPeb[0]) = 1;
KeStackAttachProcess((PRKPROCESS)v24, &ApcState);
if( MmSecureVirtualMemory(*(VOID **)&v168[1], 0x7C8ui64, 4ui64) )
**(_OWORD **)&v168[1] = *(_OWORD *)InitialPeb;
else
InformationToken = -1073741503;
if( InformationToken >= 0 )
{
v114 = *((_QWORD *)v24 + 176);
if( v114 )
{
v115 = *(_WORD *)(v114 + 8);
if( v115 == 332 || v115 == 452 )
{
v181 = *(_QWORD **)v114;
if( MmSecureVirtualMemory(v181, 0x480ui64, 4ui64) )
{
v172 = 0xFFFFFFFF00000001ui64;
BYTE3(v172) = v112;
*v181 = v172;
}
else
{
InformationToken = -1073741503;
}
}
}
}
KeUnstackDetachProcess(&ApcState);
if( InformationToken < 0 )
goto LABEL_176;
}
}
v113 = Process;
goto LABEL_347;
}
}
LABEL_174:
if( (v17 & 0x10) != 0 )
RtlReleasePrivilege(SystemInformation);
goto LABEL_176;
}
}
else if( v40 )
{
InformationToken = MmGetSectionInformation(v40, MaxSectionInfoClass, SectionInformation);
if( InformationToken < 0 )
goto LABEL_176;
v17 |= 32
* (HIBYTE(SectionInformation[12]) & 4 | (4
* (HIBYTE(SectionInformation[12]) & 2 | ((SectionInformation[16] & 1 | (2 * (SectionInformation[16] & 2 | (2 * (SectionInformation[16] & 0xF8))))) << 11))));
WORD2(ResultSize) = HIWORD(SectionInformation[11]);
v160 = HIWORD(SectionInformation[9]);
v159 = LOWORD(SectionInformation[9]);
if( !v163 )
{
v166 = 8;
v17 |= 0x800u;
}
}
LOBYTE(v53) = v142;
goto LABEL_143;
}
return result;
}Referenced by:
NtCreateUserProcess
PsCreateMinimalProcess
PspCreateProcess