SmKmKeyGenNewKey

NTSTATUS __stdcall SmKmKeyGenNewKey(PVOID BugCheckParameter2, PVOID Src, UINT32 cbBuffer){
  __int64 v3; 
  __int64 v4; 
  char *v7; 
  char *v8; 
  int v9; 
  char *v10; 
  NTSTATUS v11; 
  _ETHREAD *CurrentThread; 
  __int64 v13; 
  _QWORD *v14; 
  __int64 v15; 
  VOID *v16; 
  _WORD *v17; 
  __int64 v18; 
  _UNICODE_STRING ValueName[3]; 
  VOID *KeyHandleOut; 

  v3 = cbBuffer;
  KeyHandleOut = 0i64;
  v4 = -1i64;
  ValueName[0] = 0i64;
  do
    ++v4;
  while( *((_WORD *)Src + v4) );
  LODWORD(v7) = SSHSupportAllocateNonPaged(cbBuffer + 42 + 2 * v4, 0x474B6D73u);
  v8 = v7;
  if( !v7 )
    return -1073741670;
  memset(v7, 0i64, v3 + 42 + 2 * v4);
  *((_QWORD *)v8 + 3) = v8 + 40;
  v10 = &v8[v3 + 40];
  *((_DWORD *)v8 + 8) = v3;
  *((_QWORD *)v8 + 2) = v10;
  memmove(v10, Src, 2 * v4);
  if( !*((_QWORD *)BugCheckParameter2 + 4) )
    goto LABEL_8;
  v11 = SmKmKeyGenLoadKey((_UNICODE_STRING *)((char *)BugCheckParameter2 + 24), (_SMKM_KEY_ENTRY *)v8, &KeyHandleOut);
  v9 = v11;
  if( v11 >= 0 )
  {
LABEL_9:
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)BugCheckParameter2, 0i64);
    if( !SmKmKeyGenKeyFind((__int64)BugCheckParameter2, (unsigned __int16 *)Src) )
    {
      v14 = (char *)BugCheckParameter2 + 8;
      v15 = *((_QWORD *)BugCheckParameter2 + 1);
      if( *(PVOID *)(v15 + 8) != (char *)BugCheckParameter2 + 8 )
        __fastfail(3u);
      v16 = KeyHandleOut;
      *(_QWORD *)v8 = v15;
      *((_QWORD *)v8 + 1) = v14;
      *(_QWORD *)(v15 + 8) = v8;
      *v14 = v8;
      if( v16 )
      {
        if( *((_QWORD *)v8 + 2) )
        {
          v17 = (_WORD *)*((_QWORD *)v8 + 2);
          v13 = 0x7FFFi64;
          do
          {
            if( !*v17 )
              break;
            ++v17;
            --v13;
          }
          while( v13 );
          v18 = (0x7FFF - v13) & ((unsigned __int128)-(__int128)(unsigned __int64)v13 >> 64);
          if( v13 )
          {
            ValueName[0].Buffer = (wchar_t *)*((_QWORD *)v8 + 2);
            ValueName[0].Length = 2 * v18;
            ValueName[0].MaximumLength = 2 * v18 + 2;
          }
        }
        ZwDeleteValueKey(v16, ValueName, (_OBJECT_TYPE *)v13);
      }
      v8 = 0i64;
    }
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)BugCheckParameter2);
    KeAbPostRelease(BugCheckParameter2);
    KeLeaveCriticalRegion();
    v9 = 0;
    goto LABEL_24;
  }
  if( v11 == -1073741772 )
  {
LABEL_8:
    v9 = SmCrGenRandom(*((INT8 **)v8 + 3), (unsigned int)v3);
    if( v9 >= 0 )
      goto LABEL_9;
  }
LABEL_24:
  if( KeyHandleOut )
    ZwClose((_HANDLE)KeyHandleOut);
  if( v8 )
    CmSiFreeMemory((PPRIVILEGE_SET)v8);
  return v9;
}

Referenced by: