Giter VIP home page Giter VIP logo

kli-ex's Introduction

kli-ex

kli-ex is an extended version of kli. Just providing a modification idea. You can modify the encryption algorithm in any way you like.

Features

  • Hide Global Variables
  • Use random seeds
  • Add caching mechanism

Example1

    auto pExAllocatePoolWithTag = KLI_CALL(ExAllocatePoolWithTag, NonPagedPool, PAGE_SIZE, 'enoN');
    if (pExAllocatePoolWithTag)
    {
        dprintf("test_once:ExAllocatePoolWithTag=%p\n", pExAllocatePoolWithTag);
        KLI_CALL(ExFreePoolWithTag, pExAllocatePoolWithTag, 'enoN');
    }

Output1

void test_once(void)
{
  __int64 v0; // rax
  unsigned __int64 kernel_base; // rax
  __m128i si128; // xmm0
  __int64 v3; // rcx
  __m128i v4; // xmm1
  __int64 v5; // rdx
  unsigned __int8 v6; // r8
  int v7; // r9d
  char v8; // r10
  int v9; // r11d
  __int64 v10; // rcx
  __int64 v11; // rdx
  unsigned __int8 v12; // r8
  char v13; // r9
  char v14; // r11
  __m128i v15; // xmm0
  __int64 v16; // rcx
  __m128i v17; // xmm6
  __int64 v18; // rdx
  unsigned __int8 v19; // r8
  int v20; // r9d
  char v21; // r10
  int v22; // r11d
  __int64 v23; // rcx
  __int64 v24; // rdx
  unsigned __int8 v25; // r8
  char v26; // r9
  char v27; // r11
  __int64 v28; // rdx
  __m128i v29; // xmm0
  __int64 i; // rcx
  __int64 v31; // r8
  unsigned __int8 v32; // r9
  int v33; // r10d
  char v34; // r11
  int v35; // esi
  __int64 v36; // rcx
  __int64 v37; // r8
  unsigned __int8 v38; // r9
  char v39; // r10
  char v40; // bl
  __int64 v41; // rcx
  __int64 v42; // r8
  __m128i v43; // xmm0
  __int64 j; // rdx
  __int64 v45; // rcx
  __int64 v46; // r9
  unsigned __int8 v47; // r10
  int v48; // r11d
  char v49; // bl
  int v50; // esi
  __int64 v51; // rdx
  __int64 v52; // r9
  unsigned __int8 v53; // r10
  char v54; // r11
  char v55; // bl
  __int64 v56; // rdx
  __int64 v57; // r8
  __m128i v58; // xmm0
  __int64 k; // rcx
  __int64 v60; // rdx
  __int64 v61; // r9
  unsigned __int8 v62; // r10
  int v63; // r11d
  char v64; // bl
  int v65; // esi
  __int64 v66; // rcx
  __int64 v67; // r9
  unsigned __int8 v68; // r10
  char v69; // r11
  char v70; // bl
  __int64 v71; // rcx
  __int64 v72; // r9
  __m128i v73; // xmm0
  __int64 m; // r10
  __int64 v75; // rcx
  __int64 v76; // r11
  unsigned __int8 v77; // si
  int v78; // edi
  char v79; // bl
  int v80; // r14d
  __int64 v81; // r10
  __int64 v82; // r11
  unsigned __int8 v83; // si
  char v84; // bl
  char v85; // r14
  __int64 v86; // r10
  __int64 v87; // r11
  __m128i v88; // xmm0
  __int64 n; // rsi
  __int64 v90; // r10
  __int64 v91; // rsi
  unsigned __int8 v92; // di
  int v93; // ebx
  char v94; // r14
  int v95; // r15d
  __int64 v96; // rcx
  __int64 v97; // r9
  __int64 v98; // r11
  unsigned __int8 v99; // si
  char v100; // bl
  char v101; // r14
  __int64 v102; // r11
  __int64 v103; // r9
  __m128i v104; // xmm0
  __int64 v105; // r8
  __int64 v106; // r14
  __m128i v107; // xmm1
  unsigned __int8 v108; // r14
  __int64 v109; // r15
  int v110; // r12d
  char v111; // r13
  int v112; // edi
  __int64 v113; // r14
  __int64 v114; // r15
  unsigned __int8 v115; // r12
  char v116; // dl
  char v117; // r13
  __int64 v118; // r12
  char v119; // r15
  char *v120; // r14
  __int64 v121; // r12
  __m128i v122; // xmm0
  __int64 ii; // r9
  __int64 v124; // r10
  unsigned __int8 v125; // r11
  int v126; // esi
  char v127; // dl
  int v128; // edi
  __int64 v129; // r9
  __int64 v130; // r10
  unsigned __int8 v131; // r11
  char v132; // dl
  char v133; // di
  __int64 v134; // r9
  __int64 v135; // rcx
  __m128i v136; // xmm0
  __int64 jj; // rdx
  __int64 v138; // r8
  unsigned __int8 v139; // r10
  int v140; // r11d
  char v141; // si
  int v142; // edi
  __int64 v143; // rdx
  __int64 v144; // r8
  unsigned __int8 v145; // r10
  char v146; // r11
  char v147; // di
  __m128i v148; // xmm0
  __int64 kk; // rax
  __int64 v150; // rcx
  unsigned __int8 v151; // dl
  int v152; // r8d
  char v153; // r10
  int v154; // r11d
  __int64 v155; // rax
  __int64 v156; // rcx
  unsigned __int8 v157; // dl
  char v158; // r8
  char v159; // r11
  unsigned __int16 *v160; // rax
  __int64 v161; // rax
  unsigned __int64 v162; // rax
  __m128i v163; // xmm0
  __int64 mm; // rcx
  __int64 v165; // rdx
  unsigned __int8 v166; // r8
  int v167; // r9d
  char v168; // r10
  int v169; // r11d
  __int64 v170; // rcx
  __int64 v171; // rdx
  unsigned __int8 v172; // r8
  char v173; // r9
  char v174; // r11
  __m128i v175; // xmm0
  __int64 nn; // rcx
  __int64 v177; // rdx
  unsigned __int8 v178; // r8
  int v179; // r9d
  char v180; // r10
  int v181; // r11d
  __int64 v182; // rcx
  __int64 v183; // rdx
  unsigned __int8 v184; // r8
  char v185; // r9
  char v186; // r11
  __int64 v187; // rdx
  __m128i v188; // xmm0
  __int64 i1; // rcx
  __int64 v190; // r8
  unsigned __int8 v191; // r9
  int v192; // r10d
  char v193; // r11
  int v194; // edi
  __int64 v195; // rcx
  __int64 v196; // r8
  unsigned __int8 v197; // r9
  char v198; // r10
  char v199; // di
  __int64 v200; // rcx
  __int64 v201; // r8
  __m128i v202; // xmm0
  __int64 i2; // rdx
  __int64 v204; // rcx
  __int64 v205; // r9
  unsigned __int8 v206; // r10
  int v207; // r11d
  char v208; // di
  int v209; // r14d
  __int64 v210; // rdx
  __int64 v211; // r9
  unsigned __int8 v212; // r10
  char v213; // r11
  char v214; // r14
  __int64 v215; // rdx
  __int64 v216; // r9
  __m128i v217; // xmm0
  __int64 i3; // rcx
  __int64 v219; // rdx
  __int64 v220; // r8
  unsigned __int8 v221; // r10
  int v222; // r11d
  char v223; // di
  int v224; // r14d
  __int64 v225; // rcx
  __int64 v226; // r8
  unsigned __int8 v227; // r10
  char v228; // r11
  char v229; // r14
  __int64 v230; // rcx
  __int64 v231; // r8
  __m128i v232; // xmm0
  __int64 i4; // r10
  __int64 v234; // rcx
  __int64 v235; // r11
  unsigned __int8 v236; // r14
  int v237; // r15d
  char v238; // di
  int v239; // r12d
  __int64 v240; // r10
  __int64 v241; // r11
  unsigned __int8 v242; // r14
  char v243; // di
  char v244; // r12
  __int64 v245; // r10
  __int64 v246; // r11
  __m128i v247; // xmm0
  __int64 i5; // r14
  __int64 v249; // r10
  __int64 v250; // r14
  unsigned __int8 v251; // r15
  int v252; // r12d
  char v253; // di
  int v254; // r13d
  __int64 v255; // rcx
  __int64 v256; // r8
  __int64 v257; // r11
  unsigned __int8 v258; // r14
  char v259; // si
  char v260; // r15
  __int64 v261; // r11
  __int64 v262; // r8
  __m128i v263; // xmm0
  __int64 v264; // r9
  __int64 v265; // r15
  __m128i v266; // xmm1
  unsigned __int8 v267; // r15
  __int64 v268; // r12
  int v269; // r13d
  char v270; // si
  int v271; // edi
  __int64 v272; // r15
  __int64 v273; // r12
  unsigned __int8 v274; // r13
  char v275; // dl
  char v276; // di
  __int64 v277; // r13
  char v278; // r12
  char *v279; // r15
  __int64 v280; // r13
  __m128i v281; // xmm0
  __int64 i6; // r8
  __int64 v283; // r10
  unsigned __int8 v284; // r11
  int v285; // edi
  char v286; // dl
  int v287; // esi
  __int64 v288; // r8
  __int64 v289; // r10
  unsigned __int8 v290; // r11
  char v291; // dl
  char v292; // bl
  __int64 v293; // r8
  __int64 v294; // rcx
  __m128i v295; // xmm0
  __int64 i7; // rdx
  __int64 v297; // r9
  unsigned __int8 v298; // r10
  int v299; // r11d
  char v300; // bl
  int v301; // esi
  __int64 v302; // rdx
  __int64 v303; // r9
  unsigned __int8 v304; // r10
  char v305; // r11
  char v306; // bl
  __m128i v307; // xmm0
  __int64 i8; // rax
  __int64 v309; // rcx
  unsigned __int8 v310; // dl
  int v311; // r9d
  char v312; // r10
  int v313; // r11d
  __int64 v314; // rax
  __int64 v315; // rcx
  unsigned __int8 v316; // dl
  char v317; // r9
  char v318; // r11
  __int64 v319; // [rsp+28h] [rbp-58h]
  __int64 v320[34]; // [rsp+30h] [rbp-50h]
  unsigned __int16 *v321; // [rsp+140h] [rbp+C0h]
  __int64 v322; // [rsp+148h] [rbp+C8h]

  v0 = kli::cache::base;
  if ( kli::cache::base == 4116 )
  {
    kernel_base = kli::detail::get_kernel_base();
    v320[0] = 3786i64;
    v319 = 3596i64;
    si128 = _mm_load_si128((const __m128i *)&_xmm);
    v3 = 1i64;
    v4 = _mm_load_si128((const __m128i *)&_xmm);
    do
    {
      *(__m128i *)&v320[v3 + 1] = si128;
      si128 = _mm_add_epi8(si128, v4);
      v3 += 2i64;
    }
    while ( v3 != 33 );
    v5 = 8i64;
    v6 = 0;
    v7 = 0;
    do
    {
      v8 = *((_BYTE *)&v320[1] + v5);
      v9 = v7;
      v6 += *((_BYTE *)v320 + v7) + v8;
      *((_BYTE *)&v320[1] + v5) = *((_BYTE *)&v320[2] + v6);
      *((_BYTE *)&v320[2] + v6) = v8;
      ++v7;
      if ( v9 >= 7 )
        v7 = 0;
      ++v5;
    }
    while ( v5 != 264 );
    v10 = 0i64;
    LOBYTE(v11) = 0;
    v12 = 0;
    do
    {
      v11 = (unsigned __int8)(v11 + 1);
      v13 = *((_BYTE *)&v320[2] + v11);
      v12 += v13;
      v14 = *((_BYTE *)&v320[2] + v12);
      *((_BYTE *)&v320[2] + v11) = v14;
      *((_BYTE *)&v320[2] + v12) = v13;
      *((_BYTE *)&v320[-1] + v10++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v13 + v14));
    }
    while ( v10 != 8 );
    v0 = v319 ^ kernel_base;
    kli::cache::base = v0;
  }
  v320[0] = 3786i64;
  v319 = 3596i64;
  v15 = _mm_load_si128((const __m128i *)&_xmm);
  v16 = 1i64;
  v17 = _mm_load_si128((const __m128i *)&_xmm);
  do
  {
    *(__m128i *)&v320[v16 + 1] = v15;
    v15 = _mm_add_epi8(v15, v17);
    v16 += 2i64;
  }
  while ( v16 != 33 );
  v18 = 8i64;
  v19 = 0;
  v20 = 0;
  do
  {
    v21 = *((_BYTE *)&v320[1] + v18);
    v22 = v20;
    v19 += *((_BYTE *)v320 + v20) + v21;
    *((_BYTE *)&v320[1] + v18) = *((_BYTE *)&v320[2] + v19);
    *((_BYTE *)&v320[2] + v19) = v21;
    ++v20;
    if ( v22 >= 7 )
      v20 = 0;
    ++v18;
  }
  while ( v18 != 264 );
  v23 = 0i64;
  LOBYTE(v24) = 0;
  v25 = 0;
  do
  {
    v24 = (unsigned __int8)(v24 + 1);
    v26 = *((_BYTE *)&v320[2] + v24);
    v25 += v26;
    v27 = *((_BYTE *)&v320[2] + v25);
    *((_BYTE *)&v320[2] + v24) = v27;
    *((_BYTE *)&v320[2] + v25) = v26;
    *((_BYTE *)&v320[-1] + v23++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v26 + v27));
  }
  while ( v23 != 8 );
  v28 = v319;
  v320[0] = 3786i64;
  v319 = 3596i64;
  v29 = _mm_load_si128((const __m128i *)&_xmm);
  for ( i = 1i64; i != 33; i += 2i64 )
  {
    *(__m128i *)&v320[i + 1] = v29;
    v29 = _mm_add_epi8(v29, v17);
  }
  v31 = 8i64;
  v32 = 0;
  v33 = 0;
  do
  {
    v34 = *((_BYTE *)&v320[1] + v31);
    v35 = v33;
    v32 += *((_BYTE *)v320 + v33) + v34;
    *((_BYTE *)&v320[1] + v31) = *((_BYTE *)&v320[2] + v32);
    *((_BYTE *)&v320[2] + v32) = v34;
    ++v33;
    if ( v35 >= 7 )
      v33 = 0;
    ++v31;
  }
  while ( v31 != 264 );
  v36 = 0i64;
  LOBYTE(v37) = 0;
  v38 = 0;
  do
  {
    v37 = (unsigned __int8)(v37 + 1);
    v39 = *((_BYTE *)&v320[2] + v37);
    v38 += v39;
    v40 = *((_BYTE *)&v320[2] + v38);
    *((_BYTE *)&v320[2] + v37) = v40;
    *((_BYTE *)&v320[2] + v38) = v39;
    *((_BYTE *)&v320[-1] + v36++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v39 + v40));
  }
  while ( v36 != 8 );
  v41 = v319;
  v42 = *(int *)((v0 ^ v28) + 0x3C);
  v320[0] = 3786i64;
  v319 = 3596i64;
  v43 = _mm_load_si128((const __m128i *)&_xmm);
  for ( j = 1i64; j != 33; j += 2i64 )
  {
    *(__m128i *)&v320[j + 1] = v43;
    v43 = _mm_add_epi8(v43, v17);
  }
  v45 = v0 ^ v41;
  v46 = 8i64;
  v47 = 0;
  v48 = 0;
  do
  {
    v49 = *((_BYTE *)&v320[1] + v46);
    v50 = v48;
    v47 += *((_BYTE *)v320 + v48) + v49;
    *((_BYTE *)&v320[1] + v46) = *((_BYTE *)&v320[2] + v47);
    *((_BYTE *)&v320[2] + v47) = v49;
    ++v48;
    if ( v50 >= 7 )
      v48 = 0;
    ++v46;
  }
  while ( v46 != 264 );
  v51 = 0i64;
  LOBYTE(v52) = 0;
  v53 = 0;
  do
  {
    v52 = (unsigned __int8)(v52 + 1);
    v54 = *((_BYTE *)&v320[2] + v52);
    v53 += v54;
    v55 = *((_BYTE *)&v320[2] + v53);
    *((_BYTE *)&v320[2] + v52) = v55;
    *((_BYTE *)&v320[2] + v53) = v54;
    *((_BYTE *)&v320[-1] + v51++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v54 + v55));
  }
  while ( v51 != 8 );
  v56 = v319;
  v57 = *(unsigned int *)(v45 + v42 + 136);
  v320[0] = 3786i64;
  v319 = 3596i64;
  v58 = _mm_load_si128((const __m128i *)&_xmm);
  for ( k = 1i64; k != 33; k += 2i64 )
  {
    *(__m128i *)&v320[k + 1] = v58;
    v58 = _mm_add_epi8(v58, v17);
  }
  v60 = v0 ^ v56;
  v61 = 8i64;
  v62 = 0;
  v63 = 0;
  do
  {
    v64 = *((_BYTE *)&v320[1] + v61);
    v65 = v63;
    v62 += *((_BYTE *)v320 + v63) + v64;
    *((_BYTE *)&v320[1] + v61) = *((_BYTE *)&v320[2] + v62);
    *((_BYTE *)&v320[2] + v62) = v64;
    ++v63;
    if ( v65 >= 7 )
      v63 = 0;
    ++v61;
  }
  while ( v61 != 264 );
  v66 = 0i64;
  LOBYTE(v67) = 0;
  v68 = 0;
  do
  {
    v67 = (unsigned __int8)(v67 + 1);
    v69 = *((_BYTE *)&v320[2] + v67);
    v68 += v69;
    v70 = *((_BYTE *)&v320[2] + v68);
    *((_BYTE *)&v320[2] + v67) = v70;
    *((_BYTE *)&v320[2] + v68) = v69;
    *((_BYTE *)&v320[-1] + v66++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v69 + v70));
  }
  while ( v66 != 8 );
  v71 = v319;
  v72 = *(unsigned int *)(v60 + v57 + 28);
  v320[0] = 3786i64;
  v319 = 3596i64;
  v73 = _mm_load_si128((const __m128i *)&_xmm);
  for ( m = 1i64; m != 33; m += 2i64 )
  {
    *(__m128i *)&v320[m + 1] = v73;
    v73 = _mm_add_epi8(v73, v17);
  }
  v75 = v0 ^ v71;
  v76 = 8i64;
  v77 = 0;
  v78 = 0;
  do
  {
    v79 = *((_BYTE *)&v320[1] + v76);
    v80 = v78;
    v77 += *((_BYTE *)v320 + v78) + v79;
    *((_BYTE *)&v320[1] + v76) = *((_BYTE *)&v320[2] + v77);
    *((_BYTE *)&v320[2] + v77) = v79;
    ++v78;
    if ( v80 >= 7 )
      v78 = 0;
    ++v76;
  }
  while ( v76 != 264 );
  v81 = 0i64;
  LOBYTE(v82) = 0;
  v83 = 0;
  do
  {
    v82 = (unsigned __int8)(v82 + 1);
    v84 = *((_BYTE *)&v320[2] + v82);
    v83 += v84;
    v85 = *((_BYTE *)&v320[2] + v83);
    *((_BYTE *)&v320[2] + v82) = v85;
    *((_BYTE *)&v320[2] + v83) = v84;
    *((_BYTE *)&v320[-1] + v81++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v84 + v85));
  }
  while ( v81 != 8 );
  v86 = v319;
  v87 = *(unsigned int *)(v57 + v60 + 32);
  v320[0] = 3786i64;
  v319 = 3596i64;
  v88 = _mm_load_si128((const __m128i *)&_xmm);
  for ( n = 1i64; n != 33; n += 2i64 )
  {
    *(__m128i *)&v320[n + 1] = v88;
    v88 = _mm_add_epi8(v88, v17);
  }
  v90 = v87 + (v0 ^ v86);
  v91 = 8i64;
  v92 = 0;
  v93 = 0;
  do
  {
    v94 = *((_BYTE *)&v320[1] + v91);
    v95 = v93;
    v92 += *((_BYTE *)v320 + v93) + v94;
    *((_BYTE *)&v320[1] + v91) = *((_BYTE *)&v320[2] + v92);
    *((_BYTE *)&v320[2] + v92) = v94;
    ++v93;
    if ( v95 >= 7 )
      v93 = 0;
    ++v91;
  }
  while ( v91 != 264 );
  v96 = v72 + v75;
  v97 = 0i64;
  LOBYTE(v98) = 0;
  v99 = 0;
  do
  {
    v98 = (unsigned __int8)(v98 + 1);
    v100 = *((_BYTE *)&v320[2] + v98);
    v99 += v100;
    v101 = *((_BYTE *)&v320[2] + v99);
    *((_BYTE *)&v320[2] + v98) = v101;
    *((_BYTE *)&v320[2] + v99) = v100;
    *((_BYTE *)&v320[-1] + v97++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v100 + v101));
  }
  while ( v97 != 8 );
  v102 = *(unsigned int *)(v57 + v60 + 24);
  v103 = 0i64;
  if ( *(_DWORD *)(v57 + v60 + 24) )
  {
    v321 = (unsigned __int16 *)((v0 ^ v319) + *(unsigned int *)(v57 + v60 + 36));
    v104 = _mm_load_si128((const __m128i *)&_xmm);
    v105 = 0i64;
    while ( 1 )
    {
      v320[0] = 3786i64;
      v319 = 3596i64;
      v106 = 1i64;
      v107 = v104;
      do
      {
        *(__m128i *)&v320[v106 + 1] = v107;
        v107 = _mm_add_epi8(v107, v17);
        v106 += 2i64;
      }
      while ( v106 != 33 );
      v108 = 0;
      v109 = 8i64;
      v110 = 0;
      do
      {
        v111 = *((_BYTE *)&v320[1] + v109);
        v112 = v110;
        v108 += *((_BYTE *)v320 + v110) + v111;
        *((_BYTE *)&v320[1] + v109) = *((_BYTE *)&v320[2] + v108);
        *((_BYTE *)&v320[2] + v108) = v111;
        ++v110;
        if ( v112 >= 7 )
          v110 = 0;
        ++v109;
      }
      while ( v109 != 264 );
      v113 = 0i64;
      LOBYTE(v114) = 0;
      v115 = 0;
      do
      {
        v114 = (unsigned __int8)(v114 + 1);
        v116 = *((_BYTE *)&v320[2] + v114);
        v115 += v116;
        v117 = *((_BYTE *)&v320[2] + v115);
        *((_BYTE *)&v320[2] + v114) = v117;
        *((_BYTE *)&v320[2] + v115) = v116;
        *((_BYTE *)&v320[-1] + v113++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v116 + v117));
      }
      while ( v113 != 8 );
      v118 = *(unsigned int *)(v90 + 4 * v105);
      v119 = *(_BYTE *)((v0 ^ v319) + v118);
      if ( v119 )
      {
        v120 = (char *)(v118 + (v0 ^ v319) + 1);
        v121 = 0xCBF29CE4843FCD9Fui64;
        do
        {
          v121 = 0x100000001B3i64 * (v119 ^ (unsigned __int64)v121);
          v119 = *v120++;
        }
        while ( v119 );
        if ( v121 == 0x4E334AF717DAD95Di64 )
          break;
      }
      if ( ++v105 == v102 )
        goto LABEL_92;
    }
    v320[0] = 3786i64;
    v319 = 3596i64;
    v122 = _mm_load_si128((const __m128i *)&_xmm);
    for ( ii = 1i64; ii != 33; ii += 2i64 )
    {
      *(__m128i *)&v320[ii + 1] = v122;
      v122 = _mm_add_epi8(v122, v17);
    }
    v124 = 8i64;
    v125 = 0;
    v126 = 0;
    do
    {
      v127 = *((_BYTE *)&v320[1] + v124);
      v128 = v126;
      v125 += *((_BYTE *)v320 + v126) + v127;
      *((_BYTE *)&v320[1] + v124) = *((_BYTE *)&v320[2] + v125);
      *((_BYTE *)&v320[2] + v125) = v127;
      ++v126;
      if ( v128 >= 7 )
        v126 = 0;
      ++v124;
    }
    while ( v124 != 264 );
    v129 = 0i64;
    LOBYTE(v130) = 0;
    v131 = 0;
    do
    {
      v130 = (unsigned __int8)(v130 + 1);
      v132 = *((_BYTE *)&v320[2] + v130);
      v131 += v132;
      v133 = *((_BYTE *)&v320[2] + v131);
      *((_BYTE *)&v320[2] + v130) = v133;
      *((_BYTE *)&v320[2] + v131) = v132;
      *((_BYTE *)&v320[-1] + v129++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v132 + v133));
    }
    while ( v129 != 8 );
    v134 = v319;
    v135 = *(unsigned int *)(v96 + 4i64 * v321[(unsigned int)v105]);
    v320[0] = 3596i64;
    v319 = 3786i64;
    v136 = _mm_load_si128((const __m128i *)&_xmm);
    for ( jj = 1i64; jj != 33; jj += 2i64 )
    {
      *(__m128i *)&v320[jj + 1] = v136;
      v136 = _mm_add_epi8(v136, v17);
    }
    v138 = 8i64;
    v139 = 0;
    v140 = 0;
    do
    {
      v141 = *((_BYTE *)&v320[1] + v138);
      v142 = v140;
      v139 += *((_BYTE *)v320 + v140) + v141;
      *((_BYTE *)&v320[1] + v138) = *((_BYTE *)&v320[2] + v139);
      *((_BYTE *)&v320[2] + v139) = v141;
      ++v140;
      if ( v142 >= 7 )
        v140 = 0;
      ++v138;
    }
    while ( v138 != 264 );
    v143 = 0i64;
    LOBYTE(v144) = 0;
    v145 = 0;
    do
    {
      v144 = (unsigned __int8)(v144 + 1);
      v146 = *((_BYTE *)&v320[2] + v144);
      v145 += v146;
      v147 = *((_BYTE *)&v320[2] + v145);
      *((_BYTE *)&v320[2] + v144) = v147;
      *((_BYTE *)&v320[2] + v145) = v146;
      *((_BYTE *)&v320[-1] + v143++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v146 + v147));
    }
    while ( v143 != 8 );
    v103 = v319 ^ (v135 + (v0 ^ v134));
  }
LABEL_92:
  v320[0] = 3596i64;
  v319 = 3786i64;
  v148 = _mm_load_si128((const __m128i *)&_xmm);
  for ( kk = 1i64; kk != 33; kk += 2i64 )
  {
    *(__m128i *)&v320[kk + 1] = v148;
    v148 = _mm_add_epi8(v148, v17);
  }
  v150 = 8i64;
  v151 = 0;
  v152 = 0;
  do
  {
    v153 = *((_BYTE *)&v320[1] + v150);
    v154 = v152;
    v151 += *((_BYTE *)v320 + v152) + v153;
    *((_BYTE *)&v320[1] + v150) = *((_BYTE *)&v320[2] + v151);
    *((_BYTE *)&v320[2] + v151) = v153;
    ++v152;
    if ( v154 >= 7 )
      v152 = 0;
    ++v150;
  }
  while ( v150 != 264 );
  v155 = 0i64;
  LOBYTE(v156) = 0;
  v157 = 0;
  do
  {
    v156 = (unsigned __int8)(v156 + 1);
    v158 = *((_BYTE *)&v320[2] + v156);
    v157 += v158;
    v159 = *((_BYTE *)&v320[2] + v157);
    *((_BYTE *)&v320[2] + v156) = v159;
    *((_BYTE *)&v320[2] + v157) = v158;
    *((_BYTE *)&v320[-1] + v155++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v158 + v159));
  }
  while ( v155 != 8 );
  v160 = (unsigned __int16 *)((__int64 (__fastcall *)(_QWORD, __int64, __int64))(v319 ^ v103))(
                               0i64,
                               4096i64,
                               1701736270i64);
  if ( v160 )
  {
    v321 = v160;
    DbgPrintEx(0x4Du, 0, "test_once:ExAllocatePoolWithTag=%p\n", v160);
    v161 = kli::cache::base;
    if ( kli::cache::base == 4116 )
    {
      v162 = kli::detail::get_kernel_base();
      v320[0] = 3786i64;
      v319 = 3596i64;
      v163 = _mm_load_si128((const __m128i *)&_xmm);
      for ( mm = 1i64; mm != 33; mm += 2i64 )
      {
        *(__m128i *)&v320[mm + 1] = v163;
        v163 = _mm_add_epi8(v163, v17);
      }
      v165 = 8i64;
      v166 = 0;
      v167 = 0;
      do
      {
        v168 = *((_BYTE *)&v320[1] + v165);
        v169 = v167;
        v166 += *((_BYTE *)v320 + v167) + v168;
        *((_BYTE *)&v320[1] + v165) = *((_BYTE *)&v320[2] + v166);
        *((_BYTE *)&v320[2] + v166) = v168;
        ++v167;
        if ( v169 >= 7 )
          v167 = 0;
        ++v165;
      }
      while ( v165 != 264 );
      v170 = 0i64;
      LOBYTE(v171) = 0;
      v172 = 0;
      do
      {
        v171 = (unsigned __int8)(v171 + 1);
        v173 = *((_BYTE *)&v320[2] + v171);
        v172 += v173;
        v174 = *((_BYTE *)&v320[2] + v172);
        *((_BYTE *)&v320[2] + v171) = v174;
        *((_BYTE *)&v320[2] + v172) = v173;
        *((_BYTE *)&v320[-1] + v170++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v173 + v174));
      }
      while ( v170 != 8 );
      v161 = v319 ^ v162;
      kli::cache::base = v161;
    }
    v320[0] = 3786i64;
    v319 = 3596i64;
    v175 = _mm_load_si128((const __m128i *)&_xmm);
    for ( nn = 1i64; nn != 33; nn += 2i64 )
    {
      *(__m128i *)&v320[nn + 1] = v175;
      v175 = _mm_add_epi8(v175, v17);
    }
    v177 = 8i64;
    v178 = 0;
    v179 = 0;
    do
    {
      v180 = *((_BYTE *)&v320[1] + v177);
      v181 = v179;
      v178 += *((_BYTE *)v320 + v179) + v180;
      *((_BYTE *)&v320[1] + v177) = *((_BYTE *)&v320[2] + v178);
      *((_BYTE *)&v320[2] + v178) = v180;
      ++v179;
      if ( v181 >= 7 )
        v179 = 0;
      ++v177;
    }
    while ( v177 != 264 );
    v182 = 0i64;
    LOBYTE(v183) = 0;
    v184 = 0;
    do
    {
      v183 = (unsigned __int8)(v183 + 1);
      v185 = *((_BYTE *)&v320[2] + v183);
      v184 += v185;
      v186 = *((_BYTE *)&v320[2] + v184);
      *((_BYTE *)&v320[2] + v183) = v186;
      *((_BYTE *)&v320[2] + v184) = v185;
      *((_BYTE *)&v320[-1] + v182++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v185 + v186));
    }
    while ( v182 != 8 );
    v187 = v319;
    v320[0] = 3786i64;
    v319 = 3596i64;
    v188 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i1 = 1i64; i1 != 33; i1 += 2i64 )
    {
      *(__m128i *)&v320[i1 + 1] = v188;
      v188 = _mm_add_epi8(v188, v17);
    }
    v190 = 8i64;
    v191 = 0;
    v192 = 0;
    do
    {
      v193 = *((_BYTE *)&v320[1] + v190);
      v194 = v192;
      v191 += *((_BYTE *)v320 + v192) + v193;
      *((_BYTE *)&v320[1] + v190) = *((_BYTE *)&v320[2] + v191);
      *((_BYTE *)&v320[2] + v191) = v193;
      ++v192;
      if ( v194 >= 7 )
        v192 = 0;
      ++v190;
    }
    while ( v190 != 264 );
    v195 = 0i64;
    LOBYTE(v196) = 0;
    v197 = 0;
    do
    {
      v196 = (unsigned __int8)(v196 + 1);
      v198 = *((_BYTE *)&v320[2] + v196);
      v197 += v198;
      v199 = *((_BYTE *)&v320[2] + v197);
      *((_BYTE *)&v320[2] + v196) = v199;
      *((_BYTE *)&v320[2] + v197) = v198;
      *((_BYTE *)&v320[-1] + v195++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v198 + v199));
    }
    while ( v195 != 8 );
    v200 = v319;
    v201 = *(int *)((v161 ^ v187) + 0x3C);
    v320[0] = 3786i64;
    v319 = 3596i64;
    v202 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i2 = 1i64; i2 != 33; i2 += 2i64 )
    {
      *(__m128i *)&v320[i2 + 1] = v202;
      v202 = _mm_add_epi8(v202, v17);
    }
    v204 = v161 ^ v200;
    v205 = 8i64;
    v206 = 0;
    v207 = 0;
    do
    {
      v208 = *((_BYTE *)&v320[1] + v205);
      v209 = v207;
      v206 += *((_BYTE *)v320 + v207) + v208;
      *((_BYTE *)&v320[1] + v205) = *((_BYTE *)&v320[2] + v206);
      *((_BYTE *)&v320[2] + v206) = v208;
      ++v207;
      if ( v209 >= 7 )
        v207 = 0;
      ++v205;
    }
    while ( v205 != 264 );
    v210 = 0i64;
    LOBYTE(v211) = 0;
    v212 = 0;
    do
    {
      v211 = (unsigned __int8)(v211 + 1);
      v213 = *((_BYTE *)&v320[2] + v211);
      v212 += v213;
      v214 = *((_BYTE *)&v320[2] + v212);
      *((_BYTE *)&v320[2] + v211) = v214;
      *((_BYTE *)&v320[2] + v212) = v213;
      *((_BYTE *)&v320[-1] + v210++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v213 + v214));
    }
    while ( v210 != 8 );
    v215 = v319;
    v216 = *(unsigned int *)(v204 + v201 + 136);
    v320[0] = 3786i64;
    v319 = 3596i64;
    v217 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i3 = 1i64; i3 != 33; i3 += 2i64 )
    {
      *(__m128i *)&v320[i3 + 1] = v217;
      v217 = _mm_add_epi8(v217, v17);
    }
    v219 = v161 ^ v215;
    v220 = 8i64;
    v221 = 0;
    v222 = 0;
    do
    {
      v223 = *((_BYTE *)&v320[1] + v220);
      v224 = v222;
      v221 += *((_BYTE *)v320 + v222) + v223;
      *((_BYTE *)&v320[1] + v220) = *((_BYTE *)&v320[2] + v221);
      *((_BYTE *)&v320[2] + v221) = v223;
      ++v222;
      if ( v224 >= 7 )
        v222 = 0;
      ++v220;
    }
    while ( v220 != 264 );
    v225 = 0i64;
    LOBYTE(v226) = 0;
    v227 = 0;
    do
    {
      v226 = (unsigned __int8)(v226 + 1);
      v228 = *((_BYTE *)&v320[2] + v226);
      v227 += v228;
      v229 = *((_BYTE *)&v320[2] + v227);
      *((_BYTE *)&v320[2] + v226) = v229;
      *((_BYTE *)&v320[2] + v227) = v228;
      *((_BYTE *)&v320[-1] + v225++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v228 + v229));
    }
    while ( v225 != 8 );
    v230 = v319;
    v231 = *(unsigned int *)(v219 + v216 + 28);
    v320[0] = 3786i64;
    v319 = 3596i64;
    v232 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i4 = 1i64; i4 != 33; i4 += 2i64 )
    {
      *(__m128i *)&v320[i4 + 1] = v232;
      v232 = _mm_add_epi8(v232, v17);
    }
    v234 = v161 ^ v230;
    v235 = 8i64;
    v236 = 0;
    v237 = 0;
    do
    {
      v238 = *((_BYTE *)&v320[1] + v235);
      v239 = v237;
      v236 += *((_BYTE *)v320 + v237) + v238;
      *((_BYTE *)&v320[1] + v235) = *((_BYTE *)&v320[2] + v236);
      *((_BYTE *)&v320[2] + v236) = v238;
      ++v237;
      if ( v239 >= 7 )
        v237 = 0;
      ++v235;
    }
    while ( v235 != 264 );
    v240 = 0i64;
    LOBYTE(v241) = 0;
    v242 = 0;
    do
    {
      v241 = (unsigned __int8)(v241 + 1);
      v243 = *((_BYTE *)&v320[2] + v241);
      v242 += v243;
      v244 = *((_BYTE *)&v320[2] + v242);
      *((_BYTE *)&v320[2] + v241) = v244;
      *((_BYTE *)&v320[2] + v242) = v243;
      *((_BYTE *)&v320[-1] + v240++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v243 + v244));
    }
    while ( v240 != 8 );
    v245 = v319;
    v246 = *(unsigned int *)(v216 + v219 + 32);
    v320[0] = 3786i64;
    v319 = 3596i64;
    v247 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i5 = 1i64; i5 != 33; i5 += 2i64 )
    {
      *(__m128i *)&v320[i5 + 1] = v247;
      v247 = _mm_add_epi8(v247, v17);
    }
    v249 = v246 + (v161 ^ v245);
    v250 = 8i64;
    v251 = 0;
    v252 = 0;
    do
    {
      v253 = *((_BYTE *)&v320[1] + v250);
      v254 = v252;
      v251 += *((_BYTE *)v320 + v252) + v253;
      *((_BYTE *)&v320[1] + v250) = *((_BYTE *)&v320[2] + v251);
      *((_BYTE *)&v320[2] + v251) = v253;
      ++v252;
      if ( v254 >= 7 )
        v252 = 0;
      ++v250;
    }
    while ( v250 != 264 );
    v255 = v231 + v234;
    v256 = 0i64;
    LOBYTE(v257) = 0;
    v258 = 0;
    do
    {
      v257 = (unsigned __int8)(v257 + 1);
      v259 = *((_BYTE *)&v320[2] + v257);
      v258 += v259;
      v260 = *((_BYTE *)&v320[2] + v258);
      *((_BYTE *)&v320[2] + v257) = v260;
      *((_BYTE *)&v320[2] + v258) = v259;
      *((_BYTE *)&v320[-1] + v256++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v259 + v260));
    }
    while ( v256 != 8 );
    v261 = *(unsigned int *)(v216 + v219 + 24);
    v262 = 0i64;
    if ( *(_DWORD *)(v216 + v219 + 24) )
    {
      v322 = (v161 ^ v319) + *(unsigned int *)(v216 + v219 + 36);
      v263 = _mm_load_si128((const __m128i *)&_xmm);
      v264 = 0i64;
      while ( 1 )
      {
        v320[0] = 3786i64;
        v319 = 3596i64;
        v265 = 1i64;
        v266 = v263;
        do
        {
          *(__m128i *)&v320[v265 + 1] = v266;
          v266 = _mm_add_epi8(v266, v17);
          v265 += 2i64;
        }
        while ( v265 != 33 );
        v267 = 0;
        v268 = 8i64;
        v269 = 0;
        do
        {
          v270 = *((_BYTE *)&v320[1] + v268);
          v271 = v269;
          v267 += *((_BYTE *)v320 + v269) + v270;
          *((_BYTE *)&v320[1] + v268) = *((_BYTE *)&v320[2] + v267);
          *((_BYTE *)&v320[2] + v267) = v270;
          ++v269;
          if ( v271 >= 7 )
            v269 = 0;
          ++v268;
        }
        while ( v268 != 264 );
        v272 = 0i64;
        LOBYTE(v273) = 0;
        v274 = 0;
        do
        {
          v273 = (unsigned __int8)(v273 + 1);
          v275 = *((_BYTE *)&v320[2] + v273);
          v274 += v275;
          v276 = *((_BYTE *)&v320[2] + v274);
          *((_BYTE *)&v320[2] + v273) = v276;
          *((_BYTE *)&v320[2] + v274) = v275;
          *((_BYTE *)&v320[-1] + v272++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v275 + v276));
        }
        while ( v272 != 8 );
        v277 = *(unsigned int *)(v249 + 4 * v264);
        v278 = *(_BYTE *)((v161 ^ v319) + v277);
        if ( v278 )
        {
          v279 = (char *)(v277 + (v161 ^ v319) + 1);
          v280 = 0xCBF29CE4843FCD9Fui64;
          do
          {
            v280 = 0x100000001B3i64 * (v278 ^ (unsigned __int64)v280);
            v278 = *v279++;
          }
          while ( v278 );
          if ( v280 == 0xCC1730B76CA73B5Aui64 )
            break;
        }
        if ( ++v264 == v261 )
          goto LABEL_192;
      }
      v320[0] = 3786i64;
      v319 = 3596i64;
      v281 = _mm_load_si128((const __m128i *)&_xmm);
      for ( i6 = 1i64; i6 != 33; i6 += 2i64 )
      {
        *(__m128i *)&v320[i6 + 1] = v281;
        v281 = _mm_add_epi8(v281, v17);
      }
      v283 = 8i64;
      v284 = 0;
      v285 = 0;
      do
      {
        v286 = *((_BYTE *)&v320[1] + v283);
        v287 = v285;
        v284 += *((_BYTE *)v320 + v285) + v286;
        *((_BYTE *)&v320[1] + v283) = *((_BYTE *)&v320[2] + v284);
        *((_BYTE *)&v320[2] + v284) = v286;
        ++v285;
        if ( v287 >= 7 )
          v285 = 0;
        ++v283;
      }
      while ( v283 != 264 );
      v288 = 0i64;
      LOBYTE(v289) = 0;
      v290 = 0;
      do
      {
        v289 = (unsigned __int8)(v289 + 1);
        v291 = *((_BYTE *)&v320[2] + v289);
        v290 += v291;
        v292 = *((_BYTE *)&v320[2] + v290);
        *((_BYTE *)&v320[2] + v289) = v292;
        *((_BYTE *)&v320[2] + v290) = v291;
        *((_BYTE *)&v320[-1] + v288++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v291 + v292));
      }
      while ( v288 != 8 );
      v293 = v319;
      v294 = *(unsigned int *)(v255 + 4i64 * *(unsigned __int16 *)(v322 + 2i64 * (unsigned int)v264));
      v320[0] = 3596i64;
      v319 = 3786i64;
      v295 = _mm_load_si128((const __m128i *)&_xmm);
      for ( i7 = 1i64; i7 != 33; i7 += 2i64 )
      {
        *(__m128i *)&v320[i7 + 1] = v295;
        v295 = _mm_add_epi8(v295, v17);
      }
      v297 = 8i64;
      v298 = 0;
      v299 = 0;
      do
      {
        v300 = *((_BYTE *)&v320[1] + v297);
        v301 = v299;
        v298 += *((_BYTE *)v320 + v299) + v300;
        *((_BYTE *)&v320[1] + v297) = *((_BYTE *)&v320[2] + v298);
        *((_BYTE *)&v320[2] + v298) = v300;
        ++v299;
        if ( v301 >= 7 )
          v299 = 0;
        ++v297;
      }
      while ( v297 != 264 );
      v302 = 0i64;
      LOBYTE(v303) = 0;
      v304 = 0;
      do
      {
        v303 = (unsigned __int8)(v303 + 1);
        v305 = *((_BYTE *)&v320[2] + v303);
        v304 += v305;
        v306 = *((_BYTE *)&v320[2] + v304);
        *((_BYTE *)&v320[2] + v303) = v306;
        *((_BYTE *)&v320[2] + v304) = v305;
        *((_BYTE *)&v320[-1] + v302++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v305 + v306));
      }
      while ( v302 != 8 );
      v262 = v319 ^ (v294 + (v161 ^ v293));
    }
LABEL_192:
    v320[0] = 3596i64;
    v319 = 3786i64;
    v307 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i8 = 1i64; i8 != 33; i8 += 2i64 )
    {
      *(__m128i *)&v320[i8 + 1] = v307;
      v307 = _mm_add_epi8(v307, v17);
    }
    v309 = 8i64;
    v310 = 0;
    v311 = 0;
    do
    {
      v312 = *((_BYTE *)&v320[1] + v309);
      v313 = v311;
      v310 += *((_BYTE *)v320 + v311) + v312;
      *((_BYTE *)&v320[1] + v309) = *((_BYTE *)&v320[2] + v310);
      *((_BYTE *)&v320[2] + v310) = v312;
      ++v311;
      if ( v313 >= 7 )
        v311 = 0;
      ++v309;
    }
    while ( v309 != 264 );
    v314 = 0i64;
    LOBYTE(v315) = 0;
    v316 = 0;
    do
    {
      v315 = (unsigned __int8)(v315 + 1);
      v317 = *((_BYTE *)&v320[2] + v315);
      v316 += v317;
      v318 = *((_BYTE *)&v320[2] + v316);
      *((_BYTE *)&v320[2] + v315) = v318;
      *((_BYTE *)&v320[2] + v316) = v317;
      *((_BYTE *)&v320[-1] + v314++) ^= *((_BYTE *)&v320[2] + (unsigned __int8)(v317 + v318));
    }
    while ( v314 != 8 );
    ((void (__fastcall *)(unsigned __int16 *, __int64))(v319 ^ v262))(v321, 1701736270i64);
  }
}

Example2

    auto pAddr = KLI_CACHED_CALL(ExAllocatePoolWithTag, NonPagedPool, PAGE_SIZE, 'x1x1');
    if (pAddr)
    {
        dprintf("test_cached:pAddr=%p\n", pAddr);
        KLI_CACHED_CALL(ExFreePoolWithTag, pAddr, 'x1x1');
    }

Output2

void test_cached(void)
{
  unsigned __int64 v0; // rax
  __m128i si128; // xmm0
  __int64 v2; // rcx
  __m128i v3; // xmm6
  __int64 v4; // rdx
  unsigned __int8 v5; // r8
  int v6; // r9d
  char v7; // r10
  int v8; // r11d
  __int64 v9; // rcx
  __int64 v10; // rdx
  unsigned __int8 v11; // r8
  char v12; // r9
  char v13; // r11
  const void *v14; // rax
  const void *v15; // rsi
  unsigned __int64 v16; // rax
  __m128i v17; // xmm0
  __int64 i; // rcx
  __int64 v19; // rdx
  unsigned __int8 v20; // r8
  int v21; // r9d
  char v22; // r10
  int v23; // r11d
  __int64 v24; // rcx
  __int64 v25; // rdx
  unsigned __int8 v26; // r8
  char v27; // r9
  char v28; // r11
  __int64 v29; // [rsp+28h] [rbp-58h]
  __int64 v30[34]; // [rsp+30h] [rbp-50h]

  v0 = (unsigned __int64)KLIExAllocatePoolWithTag;
  v30[0] = 3596i64;
  v29 = 3786i64;
  si128 = _mm_load_si128((const __m128i *)&_xmm);
  v2 = 1i64;
  v3 = _mm_load_si128((const __m128i *)&_xmm);
  do
  {
    *(__m128i *)&v30[v2 + 1] = si128;
    si128 = _mm_add_epi8(si128, v3);
    v2 += 2i64;
  }
  while ( v2 != 33 );
  v4 = 8i64;
  v5 = 0;
  v6 = 0;
  do
  {
    v7 = *((_BYTE *)&v30[1] + v4);
    v8 = v6;
    v5 += *((_BYTE *)v30 + v6) + v7;
    *((_BYTE *)&v30[1] + v4) = *((_BYTE *)&v30[2] + v5);
    *((_BYTE *)&v30[2] + v5) = v7;
    ++v6;
    if ( v8 >= 7 )
      v6 = 0;
    ++v4;
  }
  while ( v4 != 264 );
  v9 = 0i64;
  LOBYTE(v10) = 0;
  v11 = 0;
  do
  {
    v10 = (unsigned __int8)(v10 + 1);
    v12 = *((_BYTE *)&v30[2] + v10);
    v11 += v12;
    v13 = *((_BYTE *)&v30[2] + v11);
    *((_BYTE *)&v30[2] + v10) = v13;
    *((_BYTE *)&v30[2] + v11) = v12;
    *((_BYTE *)&v30[-1] + v9++) ^= *((_BYTE *)&v30[2] + (unsigned __int8)(v12 + v13));
  }
  while ( v9 != 8 );
  v14 = (const void *)((__int64 (__fastcall *)(_QWORD, __int64, __int64))(v29 ^ v0))(0i64, 4096i64, 2016507953i64);
  if ( v14 )
  {
    v15 = v14;
    DbgPrintEx(0x4Du, 0, "test_cached:pAddr=%p\n", v14);
    v16 = (unsigned __int64)KLIExFreePoolWithTag;
    v30[0] = 3596i64;
    v29 = 3786i64;
    v17 = _mm_load_si128((const __m128i *)&_xmm);
    for ( i = 1i64; i != 33; i += 2i64 )
    {
      *(__m128i *)&v30[i + 1] = v17;
      v17 = _mm_add_epi8(v17, v3);
    }
    v19 = 8i64;
    v20 = 0;
    v21 = 0;
    do
    {
      v22 = *((_BYTE *)&v30[1] + v19);
      v23 = v21;
      v20 += *((_BYTE *)v30 + v21) + v22;
      *((_BYTE *)&v30[1] + v19) = *((_BYTE *)&v30[2] + v20);
      *((_BYTE *)&v30[2] + v20) = v22;
      ++v21;
      if ( v23 >= 7 )
        v21 = 0;
      ++v19;
    }
    while ( v19 != 264 );
    v24 = 0i64;
    LOBYTE(v25) = 0;
    v26 = 0;
    do
    {
      v25 = (unsigned __int8)(v25 + 1);
      v27 = *((_BYTE *)&v30[2] + v25);
      v26 += v27;
      v28 = *((_BYTE *)&v30[2] + v26);
      *((_BYTE *)&v30[2] + v25) = v28;
      *((_BYTE *)&v30[2] + v26) = v27;
      *((_BYTE *)&v30[-1] + v24++) ^= *((_BYTE *)&v30[2] + (unsigned __int8)(v27 + v28));
    }
    while ( v24 != 8 );
    ((void (__fastcall *)(const void *, __int64))(v29 ^ v16))(v15, 2016507953i64);
  }
}

Compile

  • Visual Studio 2022 & WDK10
  • llvm-msvc [link]

BackEngineerLab

Credit

Some discussions on UnknownCheats

kli-ex's People

Contributors

gmh5225 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.