Skip to content

Instantly share code, notes, and snippets.

@alexplaskett
Created Jul 15, 2021
Embed
What would you like to do?
ExpWnfCreateNameInstance
__int64 __fastcall ExpWnfCreateNameInstance(unsigned __int64 ScopeInstance, unsigned __int64 statename, __int64 a3, struct _KPROCESS *a4, struct _EX_RUNDOWN_REF **a5)
{
__int64 v5; // rax
unsigned __int64 v7; // r15
SIZE_T v10; // rdx
struct _EX_RUNDOWN_REF *v11; // rax
struct _EX_RUNDOWN_REF *nameinstance; // rdi
struct _EX_RUNDOWN_REF *v13; // r12
unsigned int v14; // esi
volatile signed __int64 *v15; // rsi
__int64 v16; // rax
__int64 v17; // r14
struct _EX_RUNDOWN_REF *v18; // rax
struct _EX_RUNDOWN_REF *v19; // r14
_QWORD *pNameSet; // rdx
bool v21; // r8
_QWORD *v22; // rax
unsigned __int64 v23; // r15
__int64 v24; // rax
__int64 v25; // r14
struct _EX_RUNDOWN_REF **v26; // r8
struct _EX_RUNDOWN_REF *v27; // rdx
SIZE_T v29; // rdx
void *StateData; // rcx
v5 = *(_QWORD *)(a3 + 8);
v7 = (statename >> 4) & 3;
if ( PsInitialSystemProcess == a4 || (_DWORD)v7 != 3 )
{
v10 = 0xB8i64;
if ( !v5 )
v10 = 0xA8i64;
v11 = (struct _EX_RUNDOWN_REF *)ExAllocatePoolWithTag(PagedPool, v10, 0x20666E57u);
}
else
{
v29 = 0xB8i64;
if ( !v5 )
v29 = 0xA8i64;
v11 = (struct _EX_RUNDOWN_REF *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v29, 0x20666E57u);
}
nameinstance = v11;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment