NtEnumerateValueKey
INT64 __fastcall NtEnumerateValueKey(
VOID *KeyHandle,
UINT64 Index,
_KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
VOID *KeyValueInformation,
UINT64 Length,
UINT64 *ResultLength){
unsigned int v8;
_ETHREAD *CurrentThread;
bool v11;
unsigned int v12;
int v13;
struct _DMA_ADAPTER *v14;
unsigned int v15;
__int64 v16;
_ETHREAD *v17;
int v18;
unsigned int v19;
_DMA_OPERATIONS *v20;
_ETHREAD *v21;
__int64 v23;
KPROCESSOR_MODE v25;
bool v26;
char v27;
char v28;
int v29;
PADAPTER_OBJECT DmaAdapter;
__int64 v31;
_DMA_OPERATIONS *DmaOperations;
int v33;
PADAPTER_OBJECT v34;
_DMA_OPERATIONS *v35;
INT64 v36[2];
PVOID v37;
PVOID Object;
PVOID v39;
SLIST_ENTRY *Argument;
int v41;
int v42;
INT64 *v43;
int v44;
__int128 v45;
__int64 v46;
int v47;
INT64 v48;
int v49;
_KEY_VALUE_INFORMATION_CLASS v50;
VOID *v51;
unsigned int v52;
UINT64 *v53;
__int64 v54;
LARGE_INTEGER v55[2];
__int128 v56;
KAPC_STATE ApcState;
void *Src[2];
char v59;
INT64 result[9];
v8 = Index;
v29 = Index;
v33 = Index;
memset(&ApcState, 0, sizeof(ApcState));
memset((INT64)result, 0i64);
*(_OWORD *)&v55[0].LowPart = 0i64;
v56 = 0i64;
DmaOperations = 0i64;
v35 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(v55, 0x20000ui64);
v27 = 0;
v28 = 0;
memset((INT64)&v48, 0i64);
DmaAdapter = 0i64;
LODWORD(v31) = 0;
*(_OWORD *)Src = 0i64;
v59 = 0;
v36[1] = (INT64)v36;
v36[0] = (INT64)v36;
v34 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v11 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
v26 = v11;
if( !v11 )
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
if( !v11 )
{
v13 = -1073741431;
v20 = 0i64;
goto LABEL_40;
}
if( (unsigned int)KeyValueInformationClass > KeyValuePartialInformation )
{
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7)
&& KeyHandle
&& (v25 = *((_BYTE *)KeGetCurrentThread() + 562),
v37 = 0i64,
ObReferenceObjectByHandle(KeyHandle, 0, (POBJECT_TYPE)CmKeyObjectType, v25, &v37, 0i64) >= 0) )
{
v20 = (_DMA_OPERATIONS *)*((_QWORD *)v37 + 1);
HalPutDmaAdapter((PADAPTER_OBJECT)v37);
}
else
{
v20 = 0i64;
}
v13 = -1073741811;
goto LABEL_40;
}
v12 = *((char *)KeGetCurrentThread() + 562);
v54 = 0i64;
Object = 0i64;
v13 = ObReferenceObjectByHandle(KeyHandle, 1u, (POBJECT_TYPE)CmKeyObjectType, v12, &Object, 0i64);
v14 = (struct _DMA_ADAPTER *)Object;
v39 = Object;
if( v13 >= 0 )
{
if( *(_DWORD *)Object == 1803104306 )
{
DmaAdapter = (PADAPTER_OBJECT)Object;
v14 = 0i64;
v39 = 0i64;
v13 = 0;
}
else
{
v13 = -1073741816;
}
}
if( v14 )
HalPutDmaAdapter(v14);
if( v13 < 0 )
{
v8 = v29;
v20 = 0i64;
goto LABEL_40;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
{
DmaOperations = DmaAdapter->DmaOperations;
v35 = DmaOperations;
}
if( (_BYTE)v12 == 1 )
{
v15 = Length;
if( (_DWORD)Length )
{
if( ((unsigned __int8)KeyValueInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)KeyValueInformation + (unsigned int)Length > 0x7FFFFFFF0000i64
|| (char *)KeyValueInformation + (unsigned int)Length < KeyValueInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v16 = (__int64)ResultLength;
if( (unsigned __int64)ResultLength >= 0x7FFFFFFF0000i64 )
v16 = 0x7FFFFFFF0000i64;
*(_DWORD *)v16 = *(_DWORD *)v16;
}
else
{
v15 = Length;
}
v17 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v17 + 242);
v28 = 1;
if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
{
v48 = (INT64)DmaAdapter;
v49 = v29;
v50 = KeyValueInformationClass;
v51 = KeyValueInformation;
v52 = v15;
v53 = ResultLength;
v18 = CmpCallCallBacksEx(
RegNtEnumerateValueKey,
(SLIST_ENTRY **)&v48,
0i64,
1,
RegNtPostEnumerateValueKey,
(INT64)DmaAdapter,
(INT64)v36);
v13 = v18;
if( v18 < 0 )
{
v11 = v26;
v8 = v29;
v20 = DmaOperations;
if( v18 == -1073740541 )
v13 = 0;
goto LABEL_40;
}
v27 = 1;
}
v13 = CmKeyBodyRemapToVirtualForEnum((__int64 *)&DmaAdapter, v12, 1u, (__int64 *)&v34);
if( v13 < 0
|| (v13 = CmpBounceContextStart((INT64)Src, (struct SLIST_ENTRY *)KeyValueInformation, v15, v12, 1), v13 < 0) )
{
v8 = v29;
LABEL_58:
v20 = DmaOperations;
v11 = v26;
goto LABEL_40;
}
if( v34 )
{
CmpAttachToRegistryProcess(&ApcState);
v8 = v29;
v13 = CmEnumerateValueKeyFromMergedView(
(__int64)DmaAdapter,
(__int64)v34,
0,
v29,
KeyValueInformationClass,
(size_t)Src[1],
v15,
(__int64)&v31,
0i64);
KiUnstackDetachProcess(&ApcState, 0i64);
}
else
{
v8 = v29;
v13 = CmEnumerateValueKey((__int64)DmaAdapter, v29, KeyValueInformationClass, (size_t)Src[1], v15, (__int64)&v31);
}
if( v13 < 0 && v13 != -2147483643 && v13 != -1073741789 )
goto LABEL_58;
v19 = v31;
*(_DWORD *)ResultLength = v31;
if( v13 != -1073741789 )
{
if( v15 >= v19 )
v15 = v19;
if( Src[0] != Src[1] )
memmove((UINT8 *)Src[0], (UINT8 *)Src[1], v15);
}
v11 = v26;
v20 = DmaOperations;
LABEL_40:
if( v34 )
HalPutDmaAdapter(v34);
if( v27
&& CmpCallBackCount
&& !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock)
&& (INT64 *)v36[0] != v36 )
{
v42 = 0;
v45 = 0i64;
v46 = 0i64;
v47 = 0;
Argument = (SLIST_ENTRY *)DmaAdapter;
v41 = v13;
v44 = v13;
v43 = &v48;
CmpCallCallBacksEx(
RegNtPostEnumerateValueKey,
&Argument,
0i64,
0,
RegNtPostEnumerateValueKey,
(INT64)DmaAdapter,
(INT64)v36);
v13 = v44;
}
if( v28 )
{
v21 = (_ETHREAD *)KeGetCurrentThread();
if( (*((_WORD *)v21 + 242))++ == 0xFFFF
&& *((_ETHREAD **)v21 + 19) != (_ETHREAD *)((char *)v21 + 152)
&& !*((_WORD *)v21 + 243) )
{
KiCheckForKernelApcDelivery();
}
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
CmpBounceContextCleanup((INT64)Src);
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
LOBYTE(v23) = 18;
(*(void(__fastcall **)(__int64, LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _QWORD))((char *)&NlsMbCodePageTag
+ 7))(
v23,
v55,
(unsigned int)v13,
v8,
v20,
0i64);
}
if( v11 )
{
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
return(unsigned int)v13;
}Referenced by:
AdtpObjsInitialize