VrpPreLoadKey
NTSTATUS __stdcall VrpPreLoadKey(_QWORD *rcx0, INT64 a2){
__int64 v4;
UNICODE_STRING *v5;
UNICODE_STRING *v6;
int v7;
NTSTATUS NamespaceNode;
PVOID *v9;
int v10;
__int64 v11;
INT64 v12;
UNICODE_STRING *v13;
int v14;
wchar_t *Buffer;
_ETHREAD *CurrentThread;
INT64 v17;
void *v18;
void *v19;
void *v20;
void *v21;
ACCESS_MASK v22;
NTSTATUS v23;
_POOL_TYPE v24;
UNICODE_STRING *v25;
int v26;
PVOID *v27;
struct _UNICODE_STRING *p_Destination;
POBJECT_TYPE ObjectType;
INT64 AccessMode;
UINT64 AccessModea;
char v33;
int v35;
struct _UNICODE_STRING Destination;
PVOID P[2];
UNICODE_STRING Source;
UNICODE_STRING InputString;
int v40;
int v41;
NTSTATUS v42;
UINT64 Position;
PVOID Object;
UNICODE_STRING *v45;
INT64 v46;
HANDLE TrustClassKey;
HANDLE Event;
HANDLE Handle;
HANDLE v50;
HANDLE v51;
UNICODE_STRING String1;
_QWORD *v53;
void *v54;
PADAPTER_OBJECT DmaAdapter;
INT64 v56;
_OBJECT_ATTRIBUTES SourceFile;
_OBJECT_ATTRIBUTES TargetKey;
GUID v59;
struct _EVENT_DATA_DESCRIPTOR v60;
int *v61;
__int64 v62;
PVOID v63;
int v64[2];
int *v65;
__int64 v66;
wchar_t *v67;
int v68[2];
int *v69;
__int64 v70;
INT64 v71[2];
int *v72;
__int64 v73;
__int64 v74;
int v75[2];
struct _EVENT_DATA_DESCRIPTOR v76;
int *v77;
__int64 v78;
char v79;
v53 = rcx0;
v56 = a2;
*(_OWORD *)P = 0i64;
*(_QWORD *)&Source.Length = 5111808i64;
memset(&SourceFile, 0, sizeof(SourceFile));
Destination = 0i64;
memset(&TargetKey, 0, sizeof(TargetKey));
InputString = 0i64;
String1 = 0i64;
v59 = 0i64;
EtwActivityIdControl(3u, &v59);
v4 = *rcx0;
Source.Buffer = (wchar_t *)&v79;
v33 = 0;
v35 = 0;
v5 = *(UNICODE_STRING **)(v4 + 72);
v46 = 0i64;
Position = 0i64;
TrustClassKey = 0i64;
Event = 0i64;
v51 = 0i64;
DmaAdapter = 0i64;
v54 = 0i64;
v6 = 0i64;
v45 = 0i64;
Handle = 0i64;
v50 = 0i64;
if( v5 )
{
VrpBuildKeyPath(v5 + 1, *(UNICODE_STRING **)(v4 + 8), (UNICODE_STRING *)P);
NamespaceNode = v7;
if( v7 < 0 )
goto LABEL_53;
v33 = 1;
}
else
{
*(_OWORD *)P = *(_OWORD *)*(_QWORD *)(v4 + 8);
}
if( (unsigned int)CallbackContext > 5 )
{
v9 = P;
if( !P[1] )
v9 = (PVOID *)&EmptyUnicodeString;
v10 = *(unsigned __int16 *)v9;
v11 = (__int64)v9[1];
v72 = v75;
v73 = 2i64;
v74 = v11;
v75[0] = v10;
v75[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&CallbackContext,
(unsigned __int8 *)byte_140023309,
&v59,
0i64,
4u,
(PEVENT_DATA_DESCRIPTOR)v71);
}
VrpGetNextToken((UNICODE_STRING *)P, &Position, &String1);
if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpRegistryString, 1u) )
{
LABEL_10:
NamespaceNode = -1073741790;
goto LABEL_55;
}
VrpGetNextToken((UNICODE_STRING *)P, &Position, &String1);
if( RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpAppString, 1u)
|| RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpWcString, 1u) )
{
NamespaceNode = 0;
}
else
{
if( (*(_DWORD *)(v4 + 24) & 0x10) != 0 )
{
NamespaceNode = 0;
v12 = a2;
goto LABEL_58;
}
v13 = (UNICODE_STRING *)&VrpMachineString;
if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpMachineString, 1u) )
{
v13 = (UNICODE_STRING *)&VrpUserString;
if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpUserString, 1u) )
goto LABEL_10;
}
InputString.Buffer = (wchar_t *)((char *)P[1] + 2 * Position);
InputString.Length = LOWORD(P[0]) - 2 * Position;
InputString.MaximumLength = InputString.Length;
VrpStripTrailingCharacters(&InputString, 2 * Position);
v14 = 0;
if( InputString.Length )
{
Buffer = InputString.Buffer;
while( *Buffer != 92 )
{
++v14;
++Buffer;
if( 2i64 * v14 >= (unsigned __int64)InputString.Length )
goto LABEL_22;
}
goto LABEL_10;
}
LABEL_22:
NamespaceNode = RtlStringFromGUIDEx((const _GUID *const)a2, &Source, 0);
if( NamespaceNode >= 0 )
{
++Source.Buffer;
Source.Length -= 4;
Source.MaximumLength -= 4;
Destination.MaximumLength = InputString.Length + v13->Length + Source.Length + 40;
Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(PagedPool, Destination.MaximumLength, 0x67655256ui64);
if( !Destination.Buffer )
{
NamespaceNode = -1073741670;
goto LABEL_55;
}
RtlAppendUnicodeStringToString(&Destination, (UNICODE_STRING *)&VrpRootHivePath);
RtlAppendUnicodeToString(&Destination, (PWCHAR)&stru_1407CDE30.TrapFrame);
RtlAppendUnicodeStringToString(&Destination, &Source);
RtlAppendUnicodeToString(&Destination, (PWCHAR)&stru_1407CDE30.OutputLength);
RtlAppendUnicodeStringToString(&Destination, v13);
RtlAppendUnicodeToString(&Destination, (PWCHAR)&stru_1407CDE30.OutputLength);
RtlAppendUnicodeStringToString(&Destination, &InputString);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx(a2 + 16, 0i64);
v35 = 1;
v40 = 1;
LODWORD(AccessMode) = -1;
LODWORD(ObjectType) = 0x80000000;
NamespaceNode = VrpCreateNamespaceNode(
a2,
(UNICODE_STRING *)P,
0i64,
(const VOID **)&Destination,
(INT64)ObjectType,
AccessMode,
(CHAR **)&v46);
if( NamespaceNode >= 0 )
{
v17 = v46;
NamespaceNode = VrpAddNamespaceNodeToList((UINT64 *)a2, (UNICODE_STRING *)v46);
if( NamespaceNode >= 0 )
{
NamespaceNode = VrpCreateNamespaceNodePlaceholderKey(v17);
if( NamespaceNode >= 0 )
{
SourceFile.Length = 48;
SourceFile.RootDirectory = 0i64;
SourceFile.Attributes = 576;
SourceFile.ObjectName = *(_UNICODE_STRING **)(v4 + 16);
*(_OWORD *)&SourceFile.SecurityDescriptor = 0i64;
TargetKey.Length = 48;
TargetKey.RootDirectory = 0i64;
TargetKey.Attributes = 576;
TargetKey.ObjectName = &Destination;
*(_OWORD *)&TargetKey.SecurityDescriptor = 0i64;
v18 = *(void **)(v4 + 32);
if( !v18
|| (NamespaceNode = ObOpenObjectByPointer(
v18,
0x200u,
0i64,
0,
(POBJECT_TYPE)CmKeyObjectType,
0,
&TrustClassKey),
NamespaceNode >= 0) )
{
v19 = *(void **)(v4 + 40);
if( !v19
|| (NamespaceNode = ObOpenObjectByPointer(
v19,
0x200u,
0i64,
2u,
(POBJECT_TYPE)ExEventObjectType,
0,
&Event),
NamespaceNode >= 0) )
{
v20 = (void *)v53[1];
if( !v20
|| (NamespaceNode = ObOpenObjectByPointer(
v20,
0x200u,
0i64,
0,
(POBJECT_TYPE)CmKeyObjectType,
0,
&Handle),
NamespaceNode >= 0) )
{
if( *(_QWORD *)(v4 + 80) != 2i64
|| (v21 = *(void **)(v4 + 88)) == 0i64
|| (NamespaceNode = ObOpenObjectByPointer(
v21,
0x200u,
0i64,
0,
(POBJECT_TYPE)SeTokenObjectType,
0,
&v50),
NamespaceNode >= 0) )
{
LODWORD(AccessModea) = *(_DWORD *)(v4 + 48);
NamespaceNode = CmLoadDifferencingKey(
&TargetKey,
&SourceFile,
*(unsigned int *)(v4 + 24),
TrustClassKey,
Event,
AccessModea,
(PVOID *)((unsigned __int64)&v51 & -(__int64)(*(_QWORD *)(v4 + 56) != 0i64)),
0i64,
Handle,
*((_BYTE *)v53 + 16));
if( NamespaceNode >= 0 )
{
if( *(_QWORD *)(v4 + 56) )
{
if( v51 )
{
v22 = *(_DWORD *)(v4 + 48);
Object = 0i64;
v23 = ObReferenceObjectByHandle(v51, v22, (POBJECT_TYPE)CmKeyObjectType, 0, &Object, 0i64);
v24 = (int)Object;
DmaAdapter = (PADAPTER_OBJECT)Object;
if( v23 >= 0 )
{
LODWORD(v25) = VrpAllocateKeyContext((PVOID)a2);
v6 = v25;
v45 = v25;
if( v25 )
{
VrpBuildKeyPath(0i64, (UNICODE_STRING *)P, v25 + 1);
if( v26 >= 0 )
{
*(_DWORD *)(&v6[2].MaximumLength + 1) = 0x20000000;
if( (int)CmSetCallbackObjectContext(v24, (UINT64)&VrpCallbackCookie) >= 0 )
{
v6 = 0i64;
v45 = 0i64;
ObOpenObjectByPointer(
Object,
*((_BYTE *)KeGetCurrentThread() + 562) != 0 ? 64 : 576,
0i64,
*(_DWORD *)(v4 + 48),
(POBJECT_TYPE)CmKeyObjectType,
*((_BYTE *)KeGetCurrentThread() + 562),
&v54);
}
}
}
}
}
**(_QWORD **)(v4 + 56) = v54;
}
NamespaceNode = -1073740541;
if( (unsigned int)CallbackContext > 5 )
{
v27 = P;
if( !P[1] )
v27 = (PVOID *)&EmptyUnicodeString;
v61 = v64;
v62 = 2i64;
v63 = v27[1];
v64[0] = *(unsigned __int16 *)v27;
v64[1] = 0;
p_Destination = &Destination;
if( !Destination.Buffer )
p_Destination = (struct _UNICODE_STRING *)&EmptyUnicodeString;
v65 = v68;
v66 = 2i64;
v67 = p_Destination->Buffer;
v68[0] = p_Destination->Length;
v68[1] = 0;
v41 = -1073740541;
v69 = &v41;
v70 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&CallbackContext,
(unsigned __int8 *)byte_1400235A8,
&v59,
0i64,
7u,
&v60);
}
}
}
}
}
}
}
}
}
}
}
LABEL_53:
if( ((NamespaceNode + 0x80000000) & 0x80000000) != 0 || NamespaceNode == -1073740541 )
{
v12 = a2;
goto LABEL_58;
}
LABEL_55:
v12 = a2;
if( v46 )
VrpDestroyNamespaceNode((UINT64 *)a2, v46);
LABEL_58:
if( v35 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v12 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(v12 + 16));
KeAbPostRelease((PVOID)(v12 + 16));
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
if( ((NamespaceNode + 0x80000000) & 0x80000000) == 0
&& NamespaceNode != -1073740541
&& (unsigned int)CallbackContext > 2 )
{
v42 = NamespaceNode;
v77 = &v42;
v78 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&CallbackContext,
(unsigned __int8 *)&dword_140023434,
&v59,
0i64,
3u,
&v76);
}
if( v6 )
VrpFreeKeyContext(v6);
if( TrustClassKey )
ObCloseHandle(TrustClassKey, 0);
if( Event )
ObCloseHandle(Event, 0);
if( Handle )
ObCloseHandle(Handle, 0);
if( v50 )
ObCloseHandle(v50, 0);
if( v51 )
ObCloseHandle(v51, 0);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v33 == 1 )
ExFreePoolWithTag(P[1], 0x67655256u);
if( Destination.Buffer )
ExFreePoolWithTag(Destination.Buffer, 0x67655256u);
return NamespaceNode;
}Referenced by:
VrpRegistryCallback