NtRenameKey

NTSTATUS __stdcall NtRenameKey(
        VOID *KeyHandle,
        _UNICODE_STRING *NewName,
        _OBJECT_TYPE *a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  char v9; 
  unsigned int PreviousMode; 
  char v11; 
  char v12; 
  _ETHREAD *CurrentThread; 
  UINT8 v14; 
  NTSTATUS v15; 
  char v16; 
  int v17; 
  wchar_t *Buffer; 
  unsigned __int64 v19; 
  unsigned __int16 v20; 
  PPRIVILEGE_SET v21; 
  INT64 v22; 
  INT8 v23; 
  PVOID *v24; 
  unsigned int v25; 
  PVOID v26; 
  UINT64 v27; 
  INT64 v28; 
  INT8 v29; 
  PVOID *v30; 
  _ETHREAD *v31; 
  int v32; 
  NTSTATUS v34; 
  UINT8 v35; 
  PADAPTER_OBJECT DmaAdapter[2]; 
  VOID *Src[2]; 
  int v38; 
  PPRIVILEGE_SET Privileges; 
  __int64 v40[2]; 
  PVOID Handle; 
  __int128 v42; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SLIST_ENTRY *Argument[2]; 
  __int128 v45; 
  __int64 v46; 
  UNICODE_STRING NewKeyName; 
  _KAPC_STATE ApcState; 

  Handle = KeyHandle;
  *(_OWORD *)Src = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v9 = 0;
  DmaAdapter[0] = 0i64;
  Privileges = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v11 = 0;
  *(_OWORD *)Argument = 0i64;
  v45 = 0i64;
  v46 = 0i64;
  v40[1] = (__int64)v40;
  v40[0] = (__int64)v40;
  v38 = 0;
  v12 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v14 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  v35 = v14;
  if( !v14 )
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( !v14 )
  {
    v15 = -1073741431;
    v34 = -1073741431;
    v16 = 0;
    goto LABEL_45;
  }
  if( (_BYTE)PreviousMode == 1 )
  {
    v42 = 0i64;
    if( (unsigned __int64)NewName >= 0x7FFFFFFF0000i64 )
      NewName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
    v17 = *(_DWORD *)&NewName->Length;
    LODWORD(v42) = v17;
    Buffer = NewName->Buffer;
    *((_QWORD *)&v42 + 1) = Buffer;
    *(_OWORD *)Src = v42;
    if( (_WORD)v17 )
    {
      if( ((unsigned __int8)Buffer & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      v19 = (unsigned __int64)Buffer + (unsigned __int16)v17;
      if( v19 > 0x7FFFFFFF0000i64 || v19 < (unsigned __int64)Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    *(_UNICODE_STRING *)Src = *NewName;
  }
  v20 = (unsigned __int16)Src[0];
  if( (unsigned __int16)(LOWORD(Src[0]) - 1) > 0x1FFu || ((__int64)Src[0] & 1) != 0 )
  {
    v15 = -1073741811;
    v34 = -1073741811;
    v16 = 0;
    goto LABEL_45;
  }
  v21 = (PPRIVILEGE_SET)Src[1];
  if( CmpDoesBufferRequireCapturing(PreviousMode, Src[1]) )
  {
    Privileges = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithQuotaTag(v22, LOWORD(Src[0]), 0x426E4D43ui64);
    if( !Privileges )
    {
      v15 = -1073741670;
      v34 = -1073741670;
      v16 = 0;
      goto LABEL_45;
    }
    v21 = Privileges;
    memmove(Privileges, Src[1], LOWORD(Src[0]));
    Src[1] = Privileges;
    v20 = (unsigned __int16)Src[0];
    WORD1(Src[0]) = Src[0];
  }
  v25 = 0;
  if( v20 >> 1 )
  {
    while( LOWORD(v21->PrivilegeCount) != 92 )
    {
      ++v25;
      v21 = (PPRIVILEGE_SET)((char *)v21 + 2);
      if( v25 >= v20 >> 1 )
        goto LABEL_24;
    }
    v15 = -1073741811;
    goto LABEL_28;
  }
LABEL_24:
  LOBYTE(v24) = PreviousMode;
  v26 = Handle;
  v15 = CmObReferenceObjectByHandle(Handle, 0x20006ui64, v23, v24, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
  v34 = v15;
  if( v15 == -1073741790 )
  {
    SeCaptureSubjectContext((INT64)&SubjectContext);
    v12 = 1;
    if( !CmDoVirtualTest(&SubjectContext, &v38) )
      goto LABEL_26;
    LOBYTE(v30) = PreviousMode;
    v15 = CmObReferenceObjectByHandle(v26, 0x20019ui64, v29, v30, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
    v34 = v15;
    if( v15 < 0 )
      goto LABEL_29;
    if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter[0]) )
    {
LABEL_26:
      v15 = -1073741790;
LABEL_28:
      v34 = v15;
LABEL_29:
      v16 = 0;
      goto LABEL_45;
    }
    v11 = 1;
  }
  v12 = v11;
  if( v15 < 0 )
    goto LABEL_29;
  v31 = (_ETHREAD *)KeGetCurrentThread();
  --v31->Tcb.KernelApcDisable;
  v16 = 1;
  if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v27, v28) )
  {
    Argument[0] = (_SLIST_ENTRY *)DmaAdapter[0];
    Argument[1] = (_SLIST_ENTRY *)Src;
    v32 = CmpCallCallBacksEx(RegNtRenameKey, Argument, 0i64, 1, RegNtPostRenameKey, (INT64)DmaAdapter[0], (INT64)v40);
    v15 = v32;
    if( v32 < 0 )
    {
      if( v32 == -1073740541 )
        v15 = 0;
      v34 = v15;
      goto LABEL_45;
    }
    v9 = 1;
  }
  if( !v11
    || (LOBYTE(v27) = PreviousMode,
        v15 = CmKeyBodyReplicateToVirtual((CM_KEY_BODY **)DmaAdapter, v27, (UINT64 *)0x20006),
        v34 = v15,
        v15 >= 0) )
  {
    CmpAttachToRegistryProcess(&ApcState);
    NewKeyName = *(UNICODE_STRING *)Src;
    v15 = CmRenameKey((CM_KEY_BODY *)DmaAdapter[0], &NewKeyName, PreviousMode);
    v34 = v15;
    KiUnstackDetachProcess(&ApcState, 0i64);
    v12 = v11;
  }
LABEL_45:
  if( v12 )
    SeReleaseSubjectContext(&SubjectContext);
  if( v9 )
  {
    v15 = CmPostCallbackNotificationEx(
            RegNtPostRenameKey,
            (_SLIST_ENTRY *)DmaAdapter[0],
            (unsigned int)v15,
            (INT64)Argument,
            0i64,
            (INT64)v40);
    v34 = v15;
  }
  if( v16 )
  {
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    v15 = v34;
  }
  if( DmaAdapter[0] )
    HalPutDmaAdapter(DmaAdapter[0]);
  if( Privileges )
    CmSiFreeMemory(Privileges);
  if( v35 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return v34;
  }
  return v15;
}

Referenced by: