VrpPostEnumerateKey
NTSTATUS __stdcall VrpPostEnumerateKey(_REG_POST_OPERATION_INFORMATION *PostInfo, _VRP_JOB_CONTEXT *JobContext){
char *ObjectContext;
VOID **PreInformation;
INT8 v5;
int Status;
__int64 *v7;
int v8;
__int64 v9;
_UNICODE_STRING *v10;
VOID **v11;
unsigned int v12;
bool v13;
NTSTATUS v14;
VOID **PoolWithTag;
unsigned int v16;
wchar_t *v17;
_ETHREAD *CurrentThread;
_VRP_JOB_CONTEXT *v19;
_EX_PUSH_LOCK *v20;
_UNICODE_STRING *ExactNamespaceNode;
INT64 v22;
int v23;
unsigned int v24;
VOID **v25;
VOID **v26;
UINT64 *v27;
NTSTATUS Key;
__int64 *v29;
_UNICODE_STRING *p_NewPath;
VOID **v31;
VOID **v32;
_KEY_INFORMATION_CLASS v34;
NTSTATUS updated;
NTSTATUS v36;
PWCHAR Filename;
PWCHAR Filenamea;
PWCHAR Filenameb;
PWCHAR Ext;
PWCHAR Exta;
VOID **Handle;
INT64 v43;
INT8 PreviousMode;
_UNICODE_STRING *v45;
UINT64 ResultLength;
wchar_t v48[4];
VOID *KeyHandle;
unsigned int v50;
unsigned int v51;
int v52;
_REG_POST_OPERATION_INFORMATION *v53;
UINT64 v54;
PVOID P;
PVOID v56;
wchar_t Dir[4];
_UNICODE_STRING Part2;
_UNICODE_STRING NewPath;
_VRP_JOB_CONTEXT *v60;
char *v61;
VOID **v62;
_OBJECT_ATTRIBUTES ObjectAttributes;
_GUID ActivityId;
_EVENT_DATA_DESCRIPTOR v65;
int *v66;
__int64 v67;
int *v68;
__int64 v69;
__int64 v70;
int v71[2];
int *v72;
__int64 v73;
wchar_t *Buffer;
int v75[2];
int *v76;
__int64 v77;
_EVENT_DATA_DESCRIPTOR v78;
int *v79;
__int64 v80;
int *v81;
__int64 v82;
__int64 v83;
int v84[2];
v53 = PostInfo;
v60 = JobContext;
NewPath = 0i64;
Part2 = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
ActivityId = 0i64;
EtwActivityIdControl(3ui64, &ActivityId);
v56 = 0i64;
ObjectContext = (char *)PostInfo->ObjectContext;
v45 = (_UNICODE_STRING *)ObjectContext;
v61 = ObjectContext;
KeyHandle = 0i64;
PreInformation = (VOID **)PostInfo->PreInformation;
v62 = PreInformation;
*(_QWORD *)Dir = 0i64;
P = 0i64;
v5 = ExGetPreviousMode();
PreviousMode = v5;
LODWORD(ResultLength) = 0;
*(_QWORD *)v48 = 0i64;
Status = PostInfo->Status;
v54 = 0i64;
if( *(&stru_140C00F40 + 1162) > 5u )
{
v50 = *((_DWORD *)PreInformation + 3);
v79 = (int *)&v50;
v80 = 4i64;
v7 = (__int64 *)(ObjectContext + 16);
if( !*((_QWORD *)ObjectContext + 3) )
v7 = &EmptyUnicodeString;
v8 = *(unsigned __int16 *)v7;
v9 = v7[1];
v81 = v84;
v82 = 2i64;
v83 = v9;
v84[0] = v8;
v84[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4648,
(unsigned __int8 *)byte_140023208,
&ActivityId,
0i64,
5u,
&v78);
}
if( Status < 0 && Status != -1073741789 && Status != -2147483643 )
{
v10 = (_UNICODE_STRING *)ObjectContext;
LABEL_52:
v19 = JobContext;
goto LABEL_53;
}
Status = VrpProcessBufferParameter(v5, PreInformation[2], *((unsigned int *)PreInformation + 6), (VOID **)Dir);
if( Status < 0 )
goto LABEL_51;
v11 = *(VOID ***)Dir;
Status = VrpOutputBufferParameter(v5, *(VOID **)Dir, *((unsigned int *)PreInformation + 6), PreInformation + 2);
if( Status < 0 )
goto LABEL_51;
Status = VrpProcessBufferParameter(v5, PreInformation[4], 4ui64, (VOID **)v48);
if( Status < 0 )
goto LABEL_51;
Status = VrpOutputBufferParameter(v5, *(VOID **)v48, 4ui64, PreInformation + 4);
if( Status < 0 )
goto LABEL_51;
if( v5 == 1 && v53->Status >= 0 )
{
v12 = *((_DWORD *)PreInformation + 3);
if( !v12 )
{
v13 = *((_DWORD *)v11 + 3) <= (unsigned int)(*((_DWORD *)PreInformation + 6) - 16);
goto LABEL_19;
}
if( v12 == 1 )
{
v13 = *((_DWORD *)v11 + 5) <= (unsigned int)(*((_DWORD *)PreInformation + 6) - 24);
LABEL_19:
if( v13 )
goto LABEL_20;
LABEL_51:
v10 = v45;
goto LABEL_52;
}
}
LABEL_20:
v14 = v53->Status;
if( v14 == -1073741789 || v14 == -2147483643 || *((_DWORD *)PreInformation + 3) == 2 )
{
LOBYTE(Ext) = v5;
Status = ObOpenObjectByPointer(
*PreInformation,
0x240ui64,
0i64,
983103,
(POBJECT_TYPE)CmKeyObjectType,
(_KPROCESSOR_MODE)Ext,
&KeyHandle);
if( Status < 0 )
goto LABEL_51;
LODWORD(Filenamea) = 0;
Status = ZwEnumerateKey(
KeyHandle,
*((unsigned int *)PreInformation + 2),
KeyBasicInformation,
0i64,
(UINT64)Filenamea,
&ResultLength);
if( (int)(Status + 0x80000000) >= 0 && Status != -1073741789 )
goto LABEL_51;
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ResultLength, 1734693462i64);
v11 = PoolWithTag;
if( !PoolWithTag )
{
Status = -1073741670;
goto LABEL_51;
}
v56 = PoolWithTag;
LODWORD(Filenameb) = ResultLength;
Status = ZwEnumerateKey(
KeyHandle,
*((unsigned int *)PreInformation + 2),
KeyBasicInformation,
PoolWithTag,
(UINT64)Filenameb,
&ResultLength);
if( Status < 0 )
goto LABEL_51;
}
v16 = *((_DWORD *)PreInformation + 3);
if( !v16 || v56 )
{
Part2.MaximumLength = *((_WORD *)v11 + 6);
Part2.Length = Part2.MaximumLength;
v17 = (wchar_t *)(v11 + 2);
}
else
{
if( v16 != 1 )
{
Status = -1073741811;
goto LABEL_51;
}
Part2.MaximumLength = *((_WORD *)v11 + 10);
Part2.Length = Part2.MaximumLength;
v17 = (wchar_t *)(v11 + 3);
}
Part2.Buffer = v17;
Status = VrpBuildKeyPath(v45 + 1, &Part2, &NewPath);
if( Status < 0 )
goto LABEL_51;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v19 = JobContext;
v20 = (_EX_PUSH_LOCK *)(JobContext + 4);
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)JobContext + 2, 0i64);
ExactNamespaceNode = VrpFindExactNamespaceNode((UINT64 *)JobContext, &NewPath, 0i64);
if( !ExactNamespaceNode
|| (ObjectAttributes.Length = 48,
ObjectAttributes.RootDirectory = 0i64,
ObjectAttributes.Attributes = 576,
ObjectAttributes.ObjectName = (_UNICODE_STRING *)((char *)ExactNamespaceNode + 24),
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
ZwOpenKey((VOID **)&v54, 0xF003Fui64, &ObjectAttributes, v22, (INT64)Filename, (INT64)Ext, (INT64)Handle, v43) < 0) )
{
Status = 0;
v10 = v45;
v23 = 1;
goto LABEL_54;
}
if( _InterlockedCompareExchange64(&v20->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v20);
KeAbPostRelease(v20);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v24 = *((_DWORD *)PreInformation + 6);
if( v24 )
{
v25 = ExAllocatePoolWithTag(1ui64, v24, 1734693462i64);
P = v25;
if( !v25 )
{
Status = -1073741670;
v10 = v45;
LABEL_53:
v23 = 0;
goto LABEL_54;
}
}
else
{
v25 = 0i64;
}
v26 = v25;
v27 = *(UINT64 **)v48;
Key = ZwQueryKey(
(VOID *)v54,
*((_KEY_INFORMATION_CLASS *)PreInformation + 3),
v25,
*((unsigned int *)PreInformation + 6),
*(UINT64 **)v48);
Status = Key;
if( Key == -1073741789 )
{
v26 = 0i64;
}
else if( (int)(Key + 0x80000000) >= 0 && Key != -2147483643 )
{
Status = 0;
LABEL_50:
v5 = PreviousMode;
goto LABEL_51;
}
v34 = *((_DWORD *)PreInformation + 3);
if( v34 != KeyFullInformation )
{
LODWORD(Exta) = 0;
updated = VrpUpdateKeyInformation(v34, v26, *((unsigned int *)PreInformation + 6), v27, &NewPath, (UINT64)Exta);
Status = updated;
if( updated < 0 && updated != -2147483643 && updated != -1073741789 )
goto LABEL_50;
}
if( Status != -2147483643 && Status != -1073741789 )
memmove(PreInformation[2], v26, *((_DWORD *)PreInformation + 6));
v5 = PreviousMode;
v36 = VrpOutputBufferParameter(PreviousMode, PreInformation[4], 4ui64, (VOID **)v48);
v10 = v45;
v19 = JobContext;
if( v36 >= 0 )
{
v53->ReturnStatus = Status;
Status = -1073740541;
}
else
{
Status = v36;
}
v23 = 0;
LABEL_54:
if( v23 )
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)v19 + 2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)v19 + 2);
KeAbPostRelease(v19 + 4);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
if( Status < 0 && *(&stru_140C00F40 + 1162) > 2u )
{
v51 = *((_DWORD *)PreInformation + 3);
v66 = (int *)&v51;
v67 = 4i64;
v29 = (__int64 *)&v10[1];
if( !v10[1].Buffer )
v29 = &EmptyUnicodeString;
v68 = v71;
v69 = 2i64;
v70 = v29[1];
v71[0] = *(unsigned __int16 *)v29;
v71[1] = 0;
p_NewPath = &NewPath;
if( !NewPath.Buffer )
p_NewPath = (_UNICODE_STRING *)&EmptyUnicodeString;
v72 = v75;
v73 = 2i64;
Buffer = p_NewPath->Buffer;
v75[0] = p_NewPath->Length;
v75[1] = 0;
v52 = Status;
v76 = &v52;
v77 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4648,
(unsigned __int8 *)word_140023332,
&ActivityId,
0i64,
8u,
&v65);
}
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
if( v54 )
ZwClose(v54);
if( P )
ExFreePoolWithTag(P, 0x67655256u);
if( v56 )
ExFreePoolWithTag(v56, 0x67655256u);
v31 = (VOID **)NewPath.Buffer;
if( NewPath.Buffer )
ExFreePoolWithTag(NewPath.Buffer, 0x67655256u);
LOBYTE(v31) = v5;
VrpCleanupBufferParameter(v31, (VOID **)Dir);
LOBYTE(v32) = v5;
VrpCleanupBufferParameter(v32, (VOID **)v48);
return Status;
}Referenced by:
VrpRegistryCallback