VrpPostEnumerateKey
INT64 __fastcall VrpPostEnumerateKey(INT64 a1, UINT64 *a2){
__int64 v3;
__int64 v4;
WCHAR *v5;
INT8 v6;
errno_t v7;
__int64 *v8;
int v9;
__int64 v10;
__int64 v11;
char *v12;
WCHAR *v13;
int v14;
bool v15;
int v16;
char *PoolWithTag;
int v18;
wchar_t *v19;
int v20;
_ETHREAD *CurrentThread;
UINT64 *v22;
INT64 *v23;
UNICODE_STRING *ExactNamespaceNode;
int v25;
unsigned int v26;
void *v27;
VOID *v28;
UINT64 *v29;
NTSTATUS Key;
__int64 *v31;
UNICODE_STRING *p_NewPath;
_KEY_INFORMATION_CLASS v34;
int updated;
NTSTATUS v36;
WCHAR *ObjectType;
WCHAR *ObjectTypea;
POBJECT_TYPE ObjectTypeb;
POBJECT_TYPE ObjectTypec;
WCHAR *AccessMode;
WCHAR *AccessModea;
UINT64 AccessModeb;
INT8 PreviousMode;
UNICODE_STRING *v45;
UINT64 ResultLength;
PULONG v48;
HANDLE KeyHandle;
int v50;
int v51;
errno_t v52;
INT64 v53;
HANDLE v54;
PVOID P;
PVOID v56;
WCHAR Dir[4];
UNICODE_STRING Source;
UNICODE_STRING NewPath;
UINT64 *v60;
__int64 v61;
__int64 v62;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
GUID ActivityId;
struct _EVENT_DATA_DESCRIPTOR v65;
int *v66;
__int64 v67;
int *v68;
__int64 v69;
__int64 v70;
int v71[2];
int *v72;
__int64 v73;
wchar_t *Buffer;
int v75[2];
int *v76;
__int64 v77;
WCHAR Ext[8];
int *v79;
__int64 v80;
int *v81;
__int64 v82;
__int64 v83;
int v84[2];
v53 = a1;
v60 = a2;
NewPath = 0i64;
Source = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
ActivityId = 0i64;
EtwActivityIdControl(3u, &ActivityId);
v56 = 0i64;
v3 = *(_QWORD *)(a1 + 40);
v45 = (UNICODE_STRING *)v3;
v61 = v3;
KeyHandle = 0i64;
v4 = *(_QWORD *)(a1 + 16);
v62 = v4;
*(_QWORD *)Dir = 0i64;
P = 0i64;
v6 = ExGetPreviousMode();
PreviousMode = v6;
LODWORD(ResultLength) = 0;
v48 = 0i64;
v7 = *(_DWORD *)(a1 + 8);
v54 = 0i64;
if( (unsigned int)CallbackContext > 5 )
{
v50 = *(_DWORD *)(v4 + 12);
v79 = &v50;
v80 = 4i64;
v8 = (__int64 *)(v3 + 16);
if( !*(_QWORD *)(v3 + 24) )
v8 = &EmptyUnicodeString;
v9 = *(unsigned __int16 *)v8;
v10 = v8[1];
v81 = v84;
v82 = 2i64;
v83 = v10;
v84[0] = v9;
v84[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&CallbackContext,
(unsigned __int8 *)byte_140023208,
&ActivityId,
0i64,
5u,
(PEVENT_DATA_DESCRIPTOR)Ext);
}
if( v7 < 0 && v7 != -1073741789 && v7 != -2147483643 )
{
v11 = v3;
LABEL_52:
v22 = a2;
goto LABEL_53;
}
LOBYTE(v5) = v6;
v7 = VrpProcessBufferParameter(
v5,
*(_QWORD *)(v4 + 16),
(PWCHAR)*(unsigned int *)(v4 + 24),
Dir,
ObjectType,
AccessMode);
if( v7 < 0 )
goto LABEL_51;
v12 = *(char **)Dir;
v7 = VrpOutputBufferParameter(v6, *(PVOID *)Dir, *(unsigned int *)(v4 + 24), (PVOID *)(v4 + 16));
if( v7 < 0 )
goto LABEL_51;
LOBYTE(v13) = v6;
v7 = VrpProcessBufferParameter(v13, *(_QWORD *)(v4 + 32), (PWCHAR)4, (PWCHAR)&v48, ObjectTypea, AccessModea);
if( v7 < 0 )
goto LABEL_51;
v7 = VrpOutputBufferParameter(v6, v48, 4ui64, (PVOID *)(v4 + 32));
if( v7 < 0 )
goto LABEL_51;
if( v6 == 1 && *(int *)(v53 + 8) >= 0 )
{
v14 = *(_DWORD *)(v4 + 12);
if( !v14 )
{
v15 = *((_DWORD *)v12 + 3) <= (unsigned int)(*(_DWORD *)(v4 + 24) - 16);
goto LABEL_19;
}
if( v14 == 1 )
{
v15 = *((_DWORD *)v12 + 5) <= (unsigned int)(*(_DWORD *)(v4 + 24) - 24);
LABEL_19:
if( v15 )
goto LABEL_20;
LABEL_51:
v11 = (__int64)v45;
goto LABEL_52;
}
}
LABEL_20:
v16 = *(_DWORD *)(v53 + 8);
if( v16 == -1073741789 || v16 == -2147483643 || *(_DWORD *)(v4 + 12) == 2 )
{
v7 = ObOpenObjectByPointer(*(PVOID *)v4, 0x240u, 0i64, 0xF003Fu, (POBJECT_TYPE)CmKeyObjectType, v6, &KeyHandle);
if( v7 < 0 )
goto LABEL_51;
LODWORD(ObjectTypeb) = 0;
v7 = ZwEnumerateKey(
KeyHandle,
*(unsigned int *)(v4 + 8),
KeyBasicInformation,
0i64,
(UINT64)ObjectTypeb,
&ResultLength);
if( (int)(v7 + 0x80000000) >= 0 && v7 != -1073741789 )
goto LABEL_51;
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, (unsigned int)ResultLength, 0x67655256ui64);
v12 = PoolWithTag;
if( !PoolWithTag )
{
v7 = -1073741670;
goto LABEL_51;
}
v56 = PoolWithTag;
LODWORD(ObjectTypec) = ResultLength;
v7 = ZwEnumerateKey(
KeyHandle,
*(unsigned int *)(v4 + 8),
KeyBasicInformation,
PoolWithTag,
(UINT64)ObjectTypec,
&ResultLength);
if( v7 < 0 )
goto LABEL_51;
}
v18 = *(_DWORD *)(v4 + 12);
if( !v18 || v56 )
{
Source.MaximumLength = *((_WORD *)v12 + 6);
Source.Length = Source.MaximumLength;
v19 = (wchar_t *)(v12 + 16);
}
else
{
if( v18 != 1 )
{
v7 = -1073741811;
goto LABEL_51;
}
Source.MaximumLength = *((_WORD *)v12 + 10);
Source.Length = Source.MaximumLength;
v19 = (wchar_t *)(v12 + 24);
}
Source.Buffer = v19;
VrpBuildKeyPath(v45 + 1, &Source, &NewPath);
v7 = v20;
if( v20 < 0 )
goto LABEL_51;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v22 = a2;
v23 = (INT64 *)(a2 + 2);
ExAcquirePushLockSharedEx((UINT64)(a2 + 2), 0i64);
ExactNamespaceNode = VrpFindExactNamespaceNode(a2, &NewPath.Length, 0i64);
if( !ExactNamespaceNode
|| (ObjectAttributes.Length = 48,
ObjectAttributes.RootDirectory = 0i64,
ObjectAttributes.Attributes = 576,
ObjectAttributes.ObjectName = (UNICODE_STRING *)((char *)ExactNamespaceNode + 24),
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
ZwOpenKey(&v54, 0xF003Fu, &ObjectAttributes) < 0) )
{
v7 = 0;
v11 = (__int64)v45;
v25 = 1;
goto LABEL_54;
}
if( _InterlockedCompareExchange64(v23, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v23);
KeAbPostRelease(v23);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v26 = *(_DWORD *)(v4 + 24);
if( v26 )
{
v27 = ExAllocatePoolWithTag(PagedPool, v26, 0x67655256ui64);
P = v27;
if( !v27 )
{
v7 = -1073741670;
v11 = (__int64)v45;
LABEL_53:
v25 = 0;
goto LABEL_54;
}
}
else
{
v27 = 0i64;
}
v28 = v27;
v29 = (UINT64 *)v48;
Key = ZwQueryKey(v54, *(KEY_INFORMATION_CLASS *)(v4 + 12), v27, *(unsigned int *)(v4 + 24), (UINT64 *)v48);
v7 = Key;
if( Key == -1073741789 )
{
v28 = 0i64;
}
else if( (int)(Key + 0x80000000) >= 0 && Key != -2147483643 )
{
v7 = 0;
LABEL_50:
v6 = PreviousMode;
goto LABEL_51;
}
v34 = *(_DWORD *)(v4 + 12);
if( v34 != KeyFullInformation )
{
LODWORD(AccessModeb) = 0;
updated = VrpUpdateKeyInformation(v34, v28, *(unsigned int *)(v4 + 24), v29, &NewPath, AccessModeb);
v7 = updated;
if( updated < 0 && updated != -2147483643 && updated != -1073741789 )
goto LABEL_50;
}
if( v7 != -2147483643 && v7 != -1073741789 )
memmove(*(UINT8 **)(v4 + 16), (UINT8 *)v28, *(unsigned int *)(v4 + 24));
v6 = PreviousMode;
v36 = VrpOutputBufferParameter(PreviousMode, *(PVOID *)(v4 + 32), 4ui64, (PVOID *)&v48);
v11 = (__int64)v45;
v22 = a2;
if( v36 >= 0 )
{
*(_DWORD *)(v53 + 24) = v7;
v7 = -1073740541;
}
else
{
v7 = v36;
}
v25 = 0;
LABEL_54:
if( v25 )
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)v22 + 2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)v22 + 2);
KeAbPostRelease(v22 + 2);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
if( v7 < 0 && (unsigned int)CallbackContext > 2 )
{
v51 = *(_DWORD *)(v4 + 12);
v66 = &v51;
v67 = 4i64;
v31 = (__int64 *)(v11 + 16);
if( !*(_QWORD *)(v11 + 24) )
v31 = &EmptyUnicodeString;
v68 = v71;
v69 = 2i64;
v70 = v31[1];
v71[0] = *(unsigned __int16 *)v31;
v71[1] = 0;
p_NewPath = &NewPath;
if( !NewPath.Buffer )
p_NewPath = (UNICODE_STRING *)&EmptyUnicodeString;
v72 = v75;
v73 = 2i64;
Buffer = p_NewPath->Buffer;
v75[0] = p_NewPath->Length;
v75[1] = 0;
v52 = v7;
v76 = &v52;
v77 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&CallbackContext,
(unsigned __int8 *)word_140023332,
&ActivityId,
0i64,
8u,
&v65);
}
if( KeyHandle )
ZwClose(KeyHandle);
if( v54 )
ZwClose(v54);
if( P )
ExFreePoolWithTag(P, 0x67655256u);
if( v56 )
ExFreePoolWithTag(v56, 0x67655256u);
if( NewPath.Buffer )
ExFreePoolWithTag(NewPath.Buffer, 0x67655256u);
VrpCleanupBufferParameter(v6, (PVOID *)Dir);
VrpCleanupBufferParameter(v6, (PVOID *)&v48);
return(unsigned int)v7;
}Referenced by:
VrpRegistryCallback