CmLoadKey
NTSTATUS __stdcall CmLoadKey(
_OBJECT_ATTRIBUTES *TargetKey,
_UNICODE_STRING *SourceFile,
UINT64 Flags,
_CM_KEY_BODY *TrustClassKeyBody,
_CM_KEY_BODY *LowerLayerKeyBody,
_KEVENT *UserEvent,
_UNICODE_STRING **PathToRoot,
PVOID *LoadKeyContext){
int v9;
_UNICODE_STRING *ObjectName;
unsigned int Length;
__int64 v13;
_UNICODE_STRING *v14;
wchar_t *PoolWithTag;
wchar_t *v16;
_UNICODE_STRING *v17;
_ETHREAD *CurrentThread;
_CHILD_LIST *v19;
int v20;
char v21;
INT64 v22;
INT64 a9;
char v24;
int v25;
NTSTATUS v26;
_DWORD *v27;
char a7;
int KeyCommon;
__int64 v30;
_UNICODE_STRING *p_Destination;
NTSTATUS v33;
int Conflict;
void *v35;
NTSTATUS v36;
unsigned int v37;
int v38;
int v39;
__int64 v40;
int v41;
int v42;
int v43;
int v44;
PVOID *Object;
PVOID *Objecta;
PVOID *Objectb;
PVOID *Objectc;
PVOID *Objectd;
char a8;
char v51[3];
__int16 v52;
__int16 v53;
__int16 v54;
__int16 v55;
__int16 v56;
__int16 v57;
ULONG_PTR v58;
INT64 a4;
NTSTATUS v60;
NTSTATUS v61;
HANDLE Handle;
PVOID v63;
PVOID v64;
_DMA_OPERATIONS **v65;
struct _KEVENT *v66;
_CM_KEY_BODY *v67;
INT64 a6;
__int64 *v69;
_CM_KEY_BODY *v70;
struct _UNICODE_STRING Destination;
__int64 v72;
__int64 v73;
__int64 v74;
__int64 v75;
KAPC_STATE ApcState;
struct _EVENT_DATA_DESCRIPTOR v77;
__int64 *v78;
__int64 v79;
__int64 v80;
__int64 v81;
__int16 *v82;
__int64 v83;
__int16 *v84;
__int64 v85;
__int16 *v86;
__int64 v87;
INT64 v88;
__int64 v89;
INT64 v90;
int v91;
int v92;
INT64 v93;
__int64 v94;
INT64 v95;
int v96;
int v97;
INT64 v98;
__int64 v99;
INT64 v100;
int v101;
int v102;
__int64 *v103;
__int64 v104;
struct _EVENT_DATA_DESCRIPTOR v105;
int *v106;
__int64 v107;
__int16 *v108;
__int64 v109;
__int16 *v110;
__int64 v111;
__int16 *v112;
__int64 v113;
INT64 v114;
__int64 v115;
__int64 v116;
int v117;
int v118;
INT64 v119;
__int64 v120;
INT64 v121;
int v122;
int v123;
INT64 v124;
__int64 v125;
INT64 v126;
int v127;
int v128;
struct _EVENT_DATA_DESCRIPTOR v129;
__int64 *v130;
__int64 v131;
int *v132;
__int64 v133;
__int64 *v134;
__int64 v135;
char v136;
__int64 *v137;
_DMA_OPERATIONS **v138;
v70 = LowerLayerKeyBody;
v66 = (struct _KEVENT *)PathToRoot;
v9 = Flags;
a6 = (INT64)LoadKeyContext;
v69 = v137;
v65 = v138;
ObjectName = TargetKey->ObjectName;
a8 = 0;
memset(&ApcState, 0, sizeof(ApcState));
v67 = TrustClassKeyBody;
v58 = 0i64;
Length = ObjectName->Length;
Handle = 0i64;
LODWORD(a4) = 0;
if( (unsigned __int16)Length >= 2u )
{
LODWORD(v13) = Length >> 1;
if( Length >> 1 )
{
do
{
v14 = TargetKey->ObjectName;
v13 = (unsigned int)(v13 - 1);
if( v14->Buffer[v13] != 92 )
break;
v14->Length -= 2;
}
while( (_DWORD)v13 );
}
}
if( TargetKey->ObjectName->Length < 2u )
return -1073741811;
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, 0x104ui64, 0x62534D43ui64);
v16 = PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v17 = TargetKey->ObjectName;
*(_QWORD *)&Destination.Length = 17039360i64;
Destination.Buffer = PoolWithTag;
if( CmpQueryHiveRedirectionFileList(v17, &Destination) )
{
p_Destination = &Destination;
if( Destination.Length == 2 )
p_Destination = SourceFile;
SourceFile = p_Destination;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown) )
{
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
ExFreePoolWithTag(v16, 0);
return -1073741431;
}
v20 = (v9 & 0x2000) != 0 ? 3 : 0;
v21 = v20 | 8;
if( (v9 & 0x4000) == 0 )
v21 = v20;
CmpAllocateTransientPoolWithTag((_HHIVE *)1, 0x1B0ui64, 0x33394D43ui64, v19);
a9 = v22;
if( !v22 )
{
v26 = -1073741670;
goto LABEL_22;
}
memset(v22, 0i64);
v51[0] = 1;
v24 = v21 | 4;
if( !v70 )
v24 = v21;
v25 = CmpCmdHiveOpen(
SourceFile,
1,
v51,
&v58,
((v9 & 0xFFFFF223 | (2 * (v9 & 0x480 | (2 * (v9 & 0x20 | ((v9 & 4) << 6)))))) << 19) | 0x1190001,
v24,
a6,
&a8,
(void *)a9);
v26 = v25;
if( v25 < 0 )
{
if( v25 != -1073741757 )
{
LODWORD(Object) = 16;
SetFailureLocation(a9, 0i64, 31i64, (unsigned int)v25, (INT64)Object);
v27 = (_DWORD *)v58;
goto LABEL_20;
}
LODWORD(Object) = 8;
if( CmpOpenHiveFile(SourceFile, 0i64, &Handle, &a4, (INT64)Object, a6, 0i64, 0i64, 0i64) >= 0 )
{
v63 = 0i64;
v33 = ObReferenceObjectByHandle(Handle, 0, *(POBJECT_TYPE *)CmIoFileObjectType, 0, &v63, 0i64);
ZwClose(Handle);
if( v33 < 0 )
{
LODWORD(Objectb) = 48;
}
else
{
Conflict = CmpResolveHiveLoadConflict(
(__int64)TargetKey,
(__int64)v63,
v9,
(__int64)v67,
v66,
a9,
v136,
v69,
v65);
HalPutDmaAdapter((PADAPTER_OBJECT)v63);
if( Conflict >= 0 )
{
v27 = (_DWORD *)v58;
goto LABEL_19;
}
LODWORD(Objectb) = 64;
}
}
else
{
LODWORD(Objectb) = 32;
}
v26 = -1073741757;
SetFailureLocation(a9, 0i64, 31i64, 3221225539i64, (INT64)Objectb);
v27 = (_DWORD *)v58;
goto LABEL_20;
}
v27 = (_DWORD *)v58;
if( (v9 & 0x2000) != 0 )
{
v35 = *(void **)(v58 + 1536);
v64 = 0i64;
v36 = ObReferenceObjectByHandle(v35, 0, *(POBJECT_TYPE *)CmIoFileObjectType, 0, &v64, 0i64);
v26 = v36;
if( v36 < 0 )
{
LODWORD(Objectc) = 80;
SetFailureLocation(a9, 0i64, 31i64, (unsigned int)v36, (INT64)Objectc);
goto LABEL_20;
}
a7 = v136;
v26 = CmpResolveHiveLoadConflict((__int64)TargetKey, (__int64)v64, v9, (__int64)v67, v66, a9, v136, v69, v65);
HalPutDmaAdapter((PADAPTER_OBJECT)v64);
if( v26 < 0 )
{
if( v26 == -1073741275 )
goto LABEL_16;
LODWORD(Objectd) = 96;
SetFailureLocation(a9, 0i64, 31i64, (unsigned int)v26, (INT64)Objectd);
LABEL_20:
if( v27 )
{
CmpAttachToRegistryProcess(&ApcState);
CmpDestroyHive(v27);
KiUnstackDetachProcess(&ApcState, 0i64);
}
goto LABEL_22;
}
LABEL_19:
v26 = 0;
goto LABEL_20;
}
a7 = v136;
LABEL_16:
if( (_BYTE)UserEvent )
v27[1038] |= 0x2000u;
KeyCommon = CmpLoadKeyCommon(
(ULONG_PTR)v27,
(__int64 *)TargetKey,
v9,
(__int64)v67,
(__int64)v70,
v66,
a7,
(volatile signed __int64 **)v65,
v51[0],
a8,
(_OWORD *)a9);
v26 = KeyCommon;
v27 = 0i64;
if( KeyCommon >= 0 )
goto LABEL_19;
LODWORD(Objecta) = 112;
SetFailureLocation(a9, 0i64, 31i64, (unsigned int)KeyCommon, (INT64)Objecta);
LABEL_22:
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
ExFreePoolWithTag(v16, 0);
if( v26 < 0 )
{
if( (unsigned int)dword_140C02130 > 5 )
{
if( tlgKeywordOn((__int64)&dword_140C02130, 0x400000000008i64) )
{
v72 = 1i64;
v78 = &v72;
v82 = &v52;
v80 = (__int64)&a4 + 4;
v38 = *(unsigned __int16 *)(a9 + 10);
v39 = *(unsigned __int16 *)(a9 + 8);
v88 = a9 + 8;
v84 = &v53;
v40 = a9 + 12;
v52 = v39;
v41 = *(unsigned __int8 *)(a9 + 394);
v91 = 12 * v39;
v95 = a9 + 108;
v96 = 12 * v38;
v100 = a9 + 396;
v103 = &v73;
v54 = v41;
v53 = v38;
v93 = a9 + 10;
v79 = 8i64;
HIDWORD(a4) = v26;
v81 = 4i64;
v83 = 2i64;
v85 = 2i64;
v86 = &v54;
v87 = 2i64;
v89 = 2i64;
v90 = a9 + 12;
v92 = 0;
v94 = 2i64;
v97 = 0;
v98 = a9 + 394;
v99 = 2i64;
v101 = 8 * v41;
v102 = 0;
v73 = 0x1000000i64;
v104 = 8i64;
tlgWriteAgg((__int64)&dword_140C02130, (unsigned __int8 *)&byte_140021CEB, a9 + 394, 0xEu, &v77);
v37 = dword_140C02130;
}
else
{
v40 = a9 + 12;
}
if( v37 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 8i64) )
{
v60 = v26;
v106 = &v60;
v108 = &v55;
v42 = *(unsigned __int16 *)(a9 + 8);
v43 = *(unsigned __int16 *)(a9 + 10);
v114 = a9 + 8;
v110 = &v56;
v44 = *(unsigned __int8 *)(a9 + 394);
v117 = 12 * v42;
v121 = a9 + 108;
v122 = 12 * v43;
v126 = a9 + 396;
v57 = v44;
v55 = v42;
v56 = v43;
v119 = a9 + 10;
v124 = a9 + 394;
v107 = 4i64;
v109 = 2i64;
v111 = 2i64;
v112 = &v57;
v113 = 2i64;
v115 = 2i64;
v116 = v40;
v118 = 0;
v120 = 2i64;
v123 = 0;
v125 = 2i64;
v127 = 8 * v44;
v128 = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)byte_140021E4B,
0i64,
0i64,
0xCu,
&v105);
}
}
}
else if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000008i64) )
{
v74 = 1i64;
v130 = &v74;
v131 = 8i64;
v132 = &v61;
v61 = v26;
v134 = &v75;
v133 = 4i64;
v75 = 0x1000000i64;
v135 = 8i64;
tlgWriteAgg((__int64)&dword_140C02130, (unsigned __int8 *)&unk_140021C98, v30, 5u, &v129);
}
if( a9 )
CmSiFreeMemory((PPRIVILEGE_SET)a9);
return v26;
}Referenced by:
CmLoadDifferencingKey