SmKmStoreAdd

NTSTATUS __stdcall SmKmStoreAdd(
        _SMKM_STORE_LIST *StoreMgr,
        VOID *Store,
        _SMKM_STORE_ADD_PARAMS *AddParams,
        UINT64 *StoreIdOut){
  unsigned int v4; 
  __int64 v5; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _EX_PUSH_LOCK *v9; 
  _ETHREAD *v10; 
  _ETHREAD *v11; 
  volatile signed __int64 *v12; 
  __int16 v13; 
  int v14; 
  REGHANDLE *v15; 
  unsigned __int64 v18; 
  _PRIVILEGE_SET *v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  _ETHREAD *CurrentThread; 
  _DWORD *v23; 

  v4 = 0;
  v23 = *(_DWORD **)AddParams;
  v5 = 0i64;
  do
  {
    if( !*(_QWORD *)&StoreMgr[2 * v5] )
    {
      LODWORD(v18) = SSHSupportAllocateNonPaged(1280, 0x61536D73u);
      v19 = (_PRIVILEGE_SET *)v18;
      if( !v18 )
        return -1073741670;
      v20 = v18 + 1280;
      if( v18 < v18 + 1280 )
      {
        v21 = v18 + 8;
        do
        {
          *(_OWORD *)(v21 - 8) = 0i64;
          *(_OWORD *)(v21 + 8) = 0i64;
          *(_QWORD *)(v21 + 24) = 0i64;
          ExInitializePushLock((PULONG_PTR)v21);
          ExWaitForRundownProtectionRelease((_EX_RUNDOWN_REF *)v21);
          *(_QWORD *)(v21 + 8) = 0i64;
          v21 += 40i64;
        }
        while( v21 - 8 < v20 );
      }
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)StoreMgr + 52, 0i64);
      if( !*(_QWORD *)&StoreMgr[2 * v5] )
      {
        *(_QWORD *)&StoreMgr[2 * v5] = v19;
        v19 = 0i64;
      }
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)StoreMgr + 52, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)StoreMgr + 52);
      KeAbPostRelease(StoreMgr + 104);
      KeLeaveCriticalRegion();
      if( v19 )
        CmSiFreeMemory(v19);
    }
    v7 = *(_QWORD *)&StoreMgr[2 * v5];
    v8 = v7 + 1280;
    if( v7 >= v7 + 1280 )
      goto LABEL_35;
    v9 = (_EX_PUSH_LOCK *)(v7 + 16);
    while( *(_QWORD *)v7 )
    {
LABEL_6:
      v7 += 40i64;
      v9 += 5;
      ++v4;
      if( v7 >= v8 )
        goto LABEL_9;
    }
    v10 = (_ETHREAD *)KeGetCurrentThread();
    --v10->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(v9, 0i64);
    if( *(_QWORD *)v7 )
    {
      if( (_InterlockedExchangeAdd64(&v9->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v9);
      KeAbPostRelease(v9);
      KeLeaveCriticalRegion();
      goto LABEL_6;
    }
LABEL_9:
    if( v7 < v8 )
      break;
LABEL_35:
    v5 = (unsigned int)(v5 + 1);
  }
  while( (unsigned int)v5 < 0x20 );
  if( v4 >= 0x400 )
    return -1073741671;
  v11 = (_ETHREAD *)KeGetCurrentThread();
  --v11->Tcb.KernelApcDisable;
  v12 = (volatile signed __int64 *)(StoreMgr + 104);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)StoreMgr + 52, 0i64);
  if( (*v23 & 0x100) == 0 )
    goto LABEL_12;
  if( StoreMgr[108] == -1 )
  {
    StoreMgr[108] = v4;
LABEL_12:
    *(_BYTE *)(v7 + 34) &= ~1u;
    *(_BYTE *)(v7 + 34) &= ~2u;
    *(_WORD *)(v7 + 32) ^= (*(_WORD *)(v7 + 32) ^ (*v23 >> 18 << 7)) & 0x80;
    *(_QWORD *)(v7 + 24) = *((_QWORD *)AddParams + 2);
    ++StoreMgr[106];
    if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)StoreMgr + 52);
    KeAbPostRelease(StoreMgr + 104);
    KeLeaveCriticalRegion();
    *(_QWORD *)v7 = Store;
    do
    {
      v13 = *(_WORD *)(v7 + 32) ^ (*(_WORD *)(v7 + 32) ^ (*(_WORD *)(v7 + 32) + 1)) & 0x3F;
      *(_WORD *)(v7 + 32) = v13;
      v14 = v4 | ((v13 & 0x3F) << 10);
      *(_DWORD *)StoreIdOut = v14;
    }
    while( v14 == 66559 );
    v15 = (REGHANDLE *)SmEtwEnabled(SmEtwKeywordStoreOps);
    if( v15 )
      SmKmEtwLogStoreChange(v15, *(_QWORD *)v7, SmEventStoreCreate);
    _InterlockedExchange64((volatile __int64 *)(v7 + 8), 0i64);
    ExAcquireRundownProtection((_EX_RUNDOWN_REF *)(v7 + 8));
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v7 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v7 + 16));
    KeAbPostRelease((VOID *)(v7 + 16));
    KeLeaveCriticalRegion();
    return 0;
  }
  else
  {
    if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)StoreMgr + 52);
    KeAbPostRelease(StoreMgr + 104);
    KeLeaveCriticalRegion();
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v7 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v7 + 16));
    KeAbPostRelease((VOID *)(v7 + 16));
    KeLeaveCriticalRegion();
    return -1073740757;
  }
}

Referenced by: