NtReplaceKey

VOID __stdcall NtReplaceKey(OBJECT_ATTRIBUTES *NewFile, PVOID TargetHandle, OBJECT_ATTRIBUTES *OldFile){
  char v3; 
  INT8 v7; 
  _ETHREAD *CurrentThread; 
  bool v9; 
  int v10; 
  _ETHREAD *v11; 
  INT8 v12; 
  PVOID *v13; 
  NTSTATUS v14; 
  UINT64 v15; 
  PADAPTER_OBJECT v16; 
  int v17; 
  unsigned int v18; 
  int v19; 
  PADAPTER_OBJECT DmaAdapter; 
  INT64 a6[2]; 
  PVOID P[2]; 
  PVOID v23[2]; 
  __int64 v24; 
  __int64 v25; 
  SLIST_ENTRY *Argument[2]; 
  __int128 v27; 
  __int128 v28; 
  struct _EVENT_DATA_DESCRIPTOR v29; 
  int *v30; 
  __int64 v31; 
  __int64 *v32; 
  __int64 v33; 
  struct _EVENT_DATA_DESCRIPTOR v34; 
  __int64 *v35; 
  __int64 v36; 
  DmaAdapter = 0i64;
  v3 = 0;
  v7 = *((_BYTE *)KeGetCurrentThread() + 562);
  a6[1] = (INT64)a6;
  a6[0] = (INT64)a6;
  *(_OWORD *)v23 = 0i64;
  *(_OWORD *)P = 0i64;
  *(_OWORD *)Argument = 0i64;
  v27 = 0i64;
  v28 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  if( v9 )
  {
    v10 = CmCheckNoTxContext();
    if( v10 >= 0 )
    {
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, v7) )
      {
        v11 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v11 + 242);
        v3 = 1;
        v10 = CmpNameFromAttributes(NewFile, v7, (UNICODE_STRING *)v23);
        if( v10 >= 0 )
        {
          v10 = CmpNameFromAttributes(OldFile, v7, (UNICODE_STRING *)P);
          if( v10 >= 0 )
          {
            LOBYTE(v13) = v7;
            v14 = CmObReferenceObjectByHandle(TargetHandle, 0i64, v12, v13, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
            v16 = DmaAdapter;
            v10 = v14;
            if( v14 >= 0 )
            {
              if( (LODWORD(DmaAdapter->DmaOperations->PutDmaAdapter) & 0x80u) == 0 )
              {
                if( !CmpCallBackCount
                  || ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock)
                  || (Argument[0] = (SLIST_ENTRY *)v16,
                      Argument[1] = (SLIST_ENTRY *)P,
                      *(_QWORD *)&v27 = v23,
                      v17 = CmpCallCallBacksEx(
                              RegNtPreReplaceKey,
                              Argument,
                              0i64,
                              1,
                              RegNtPostReplaceKey,
                              0i64,
                              (INT64)a6),
                      v10 = v17,
                      v17 >= 0) )
                {
                  v18 = CmReplaceKey(
                          (_HHIVE *)v16->DmaOperations->AllocateAdapterChannel,
                          v15,
                          (_UNICODE_STRING *)v23,
                          (_UNICODE_STRING *)P);
                  v10 = CmPostCallbackNotificationEx(
                          RegNtPostReplaceKey,
                          (SLIST_ENTRY *)v16,
                          v18,
                          (INT64)Argument,
                          0i64,
                          (INT64)a6);
                  if( v10 == -1073740541 )
                    v10 = 0;
                }
                else if( v17 == -1073740541 )
                {
                  v10 = 0;
                }
              }
              else
              {
                v10 = -1073741790;
              }
            }
            if( v16 )
              HalPutDmaAdapter(v16);
          }
        }
      }
      else
      {
        v10 = -1073741727;
      }
    }
  }
  else
  {
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    v10 = -1073741431;
  }
  if( P[1] )
    ExFreePoolWithTag(P[1], 0);
  if( v23[1] )
    ExFreePoolWithTag(v23[1], 0);
  if( v3 )
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v9 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  if( v10 >= 0 )
  {
    if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
    {
      v25 = 0x1000000i64;
      v35 = &v25;
      v36 = 8i64;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C02130,
        (unsigned __int8 *)&dword_140021AD4,
        0i64,
        0i64,
        3u,
        &v34);
    }
  }
  else if( (unsigned int)dword_140C02130 > 5 )
  {
    if( tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
    {
      v19 = v10;
      v30 = &v19;
      v24 = 0x1000000i64;
      v32 = &v24;
      v31 = 4i64;
      v33 = 8i64;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C02130,
        (unsigned __int8 *)byte_140021A98,
        0i64,
        0i64,
        4u,
        &v29);
    }
  }
}

Referenced by: