NtFlushKey

NTSTATUS __stdcall NtFlushKey(PVOID KeyHandle){
  _DMA_OPERATIONS *DmaOperations; 
  char v3; 
  _ETHREAD *CurrentThread; 
  bool v5; 
  INT8 v6; 
  PVOID *v7; 
  _ETHREAD *v8; 
  bool v9; 
  NTSTATUS v10; 
  _ETHREAD *v11; 
  PADAPTER_OBJECT v12; 
  int v13; 
  _DMA_OPERATIONS *v14; 
  UINT64 v15; 
  struct _EX_RUNDOWN_REF *v16; 
  struct _EX_RUNDOWN_REF *v17; 
  EVENT_DESCRIPTOR *v18; 
  PADAPTER_OBJECT v19; 
  PADAPTER_OBJECT DmaAdapter; 
  INT64 a6[2]; 
  SLIST_ENTRY *Argument[2]; 
  __int128 v24; 
  KAPC_STATE ApcState; 
  LARGE_INTEGER v26[2]; 
  __int128 v27; 
  DmaOperations = 0i64;
  *(_OWORD *)Argument = 0i64;
  v24 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_OWORD *)&v26[0].LowPart = 0i64;
  v27 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp(v26, 0x20000ui64);
  DmaAdapter = 0i64;
  a6[1] = (INT64)a6;
  v3 = 0;
  a6[0] = (INT64)a6;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v5 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  v8 = (_ETHREAD *)KeGetCurrentThread();
  v9 = v5;
  if( !v5 )
  {
    KeLeaveCriticalRegionThread((__int64)v8);
    v10 = -1073741431;
    goto LABEL_21;
  }
  LOBYTE(v7) = *((_BYTE *)v8 + 562);
  v10 = CmObReferenceObjectByHandle(KeyHandle, 0i64, v6, v7, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
  if( v10 >= 0 )
  {
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
      DmaOperations = DmaAdapter->DmaOperations;
    v11 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v11 + 242);
    v12 = DmaAdapter;
    if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
    {
      Argument[0] = (SLIST_ENTRY *)v12;
      v13 = CmpCallCallBacksEx(RegNtPreFlushKey, Argument, 0i64, 1, RegNtPostFlushKey, (INT64)v12, (INT64)a6);
      v10 = v13;
      if( v13 < 0 )
      {
        if( v13 == -1073740541 )
          v10 = 0;
        goto LABEL_18;
      }
      v3 = 1;
    }
    CmpLockRegistryFreezeAware(0);
    v14 = v12->DmaOperations;
    ExAcquirePushLockSharedEx((UINT64)&v14->FreeAdapterChannel, 0i64);
    _InterlockedIncrement((volatile signed __int32 *)&v14->FreeMapRegisters);
    v10 = CmpPerformKeyBodyDeletionCheck((__int64)DmaAdapter, 0i64);
    if( v10 >= 0 )
    {
      v15 = (UINT64)v12->DmaOperations;
      v16 = *(struct _EX_RUNDOWN_REF **)(v15 + 32);
      if( v16 == (struct _EX_RUNDOWN_REF *)CmpMasterHive )
      {
        CmpUnlockKcb(v15);
        CmpUnlockRegistry();
        CmpAttachToRegistryProcess(&ApcState);
        CmpDoFlushAll(0i64);
        KiUnstackDetachProcess(&ApcState, 0i64);
        v10 = 0;
        goto LABEL_16;
      }
      v17 = v16 + 204;
      if( ExAcquireRundownProtection(v16 + 204) )
      {
        CmpUnlockKcb((UINT64)v12->DmaOperations);
        CmpUnlockRegistry();
        CmpAttachToRegistryProcess(&ApcState);
        v10 = CmpFlushHive((ULONG_PTR)v16, 0, v18);
        if( v10 < 0 )
          v10 = -1073741491;
        KiUnstackDetachProcess(&ApcState, 0i64);
        ExReleaseRundownProtection(v17);
        goto LABEL_16;
      }
      v10 = -1073740763;
    }
    CmpUnlockKcb((UINT64)v12->DmaOperations);
    CmpUnlockRegistry();
LABEL_16:
    if( v3 )
      v10 = CmPostCallbackNotificationEx(
              RegNtPostFlushKey,
              (SLIST_ENTRY *)DmaAdapter,
              (unsigned int)v10,
              (INT64)Argument,
              0i64,
              (INT64)a6);
LABEL_18:
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  v19 = DmaAdapter;
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
LABEL_21:
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v19) = 21;
    (*(void(__fastcall **)(PADAPTER_OBJECT, LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      v19,
      v26,
      (unsigned int)v10,
      0i64,
      DmaOperations,
      0i64);
  }
  if( v9 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  return v10;
}

Referenced by: