NtDeleteValueKey
NTSTATUS __stdcall NtDeleteValueKey(PVOID KeyHandle, UNICODE_STRING *ValueName){
char v3;
_DMA_OPERATIONS *DmaOperations;
unsigned int v5;
char v6;
_ETHREAD *CurrentThread;
bool v8;
INT8 v9;
PVOID *v10;
NTSTATUS v11;
int v12;
wchar_t *Buffer;
unsigned __int64 v14;
unsigned int v15;
char *v16;
INT64 v17;
struct _PRIVILEGE_SET *TransientPoolWithQuotaTag;
char v19;
char v20;
char *i;
_ETHREAD *v22;
INT8 v24;
PVOID *v25;
void **v26;
char v27;
NTSTATUS v28;
bool v29;
PADAPTER_OBJECT DmaAdapter[2];
void *Src[2];
int v32;
__int64 v33;
PVOID Handle;
PPRIVILEGE_SET Privileges;
_DMA_OPERATIONS *v36;
INT64 a6[3];
__int128 v38;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
SLIST_ENTRY *Argument[2];
__int128 v41;
__int64 v42;
__int128 v43;
LARGE_INTEGER v44[4];
Handle = KeyHandle;
*(_OWORD *)Argument = 0i64;
v41 = 0i64;
v42 = 0i64;
v33 = 0i64;
*(_OWORD *)Src = 0i64;
Privileges = 0i64;
v3 = 0;
v32 = 0;
memset(v44, 0, sizeof(v44));
DmaOperations = 0i64;
v36 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(v44, 0x20000ui64);
v27 = 0;
DmaAdapter[0] = 0i64;
a6[1] = (INT64)a6;
a6[0] = (INT64)a6;
v5 = *((char *)KeGetCurrentThread() + 562);
v6 = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v8 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
v29 = v8;
if( !v8 )
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
if( !v8 )
{
v11 = -1073741431;
goto LABEL_54;
}
LOBYTE(v10) = v5;
v11 = CmObReferenceObjectByHandle(Handle, 2ui64, v9, v10, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
v28 = v11;
if( v11 != -1073741790 )
goto LABEL_7;
SeCaptureSubjectContext(&SubjectContext);
v6 = 1;
if( !CmDoVirtualTest((UINT64 *)&SubjectContext) )
goto LABEL_53;
LOBYTE(v25) = v5;
v11 = CmObReferenceObjectByHandle(Handle, 0x20019ui64, v24, v25, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
v28 = v11;
if( v11 < 0 )
goto LABEL_55;
if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter[0]) )
{
LABEL_53:
v11 = -1073741790;
LABEL_54:
v28 = v11;
goto LABEL_55;
}
v3 = 1;
LABEL_7:
v6 = v3;
if( v11 < 0 )
{
LABEL_55:
v19 = 0;
v20 = 0;
goto LABEL_37;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter[0] )
{
DmaOperations = DmaAdapter[0]->DmaOperations;
v36 = DmaOperations;
}
if( (_BYTE)v5 == 1 )
{
v38 = 0i64;
if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
ValueName = (UNICODE_STRING *)0x7FFFFFFF0000i64;
v12 = *(_DWORD *)&ValueName->Length;
LODWORD(v38) = v12;
Buffer = ValueName->Buffer;
*((_QWORD *)&v38 + 1) = Buffer;
*(_OWORD *)Src = v38;
if( (_WORD)v12 )
{
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v14 = (unsigned __int64)Buffer + (unsigned __int16)v12;
if( v14 > 0x7FFFFFFF0000i64 || v14 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
*(UNICODE_STRING *)Src = *ValueName;
}
v15 = LOWORD(Src[0]);
v16 = (char *)((unsigned __int64)Src[1] & -(__int64)(LOWORD(Src[0]) != 0));
Src[1] = v16;
WORD1(Src[0]) = Src[0];
if( LOWORD(Src[0]) && CmpDoesBufferRequireCapturing(v5, v16) )
{
TransientPoolWithQuotaTag = (struct _PRIVILEGE_SET *)CmpAllocateTransientPoolWithQuotaTag(v17, v15, 0x62634D43ui64);
Privileges = TransientPoolWithQuotaTag;
if( !TransientPoolWithQuotaTag )
{
v11 = -1073741670;
v28 = -1073741670;
v6 = v3;
v19 = 0;
v20 = 0;
goto LABEL_37;
}
v16 = (char *)TransientPoolWithQuotaTag;
memmove((UINT8 *)TransientPoolWithQuotaTag, (UINT8 *)Src[1], LOWORD(Src[0]));
Src[1] = v16;
LOWORD(v15) = Src[0];
}
if( ((__int64)Src[0] & 1) != 0 )
{
LOWORD(Src[0]) = 0;
v11 = -1073741811;
}
else
{
if( (LODWORD(DmaAdapter[0]->DmaOperations->PutDmaAdapter) & 0x80u) == 0 )
{
for( i = &v16[2 * ((unsigned __int64)(unsigned __int16)v15 >> 1) - 2]; (_WORD)v15 && !*(_WORD *)i; i -= 2 )
{
LOWORD(v15) = v15 - 2;
LOWORD(Src[0]) = v15;
}
v22 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v22 + 242);
v19 = 1;
if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
{
Argument[0] = (SLIST_ENTRY *)DmaAdapter[0];
Argument[1] = (SLIST_ENTRY *)Src;
v11 = CmpCallCallBacksEx(
RegNtDeleteValueKey,
Argument,
0i64,
1,
RegNtPostDeleteValueKey,
(INT64)DmaAdapter[0],
(INT64)a6);
if( v11 < 0 )
{
if( v11 == -1073740541 )
v11 = 0;
goto LABEL_70;
}
v27 = 1;
}
if( !v3 )
goto LABEL_34;
v11 = CmKeyBodyRemapToVirtual((__int64 *)DmaAdapter, v5, 2u, (__int64)&SubjectContext, &v32);
v28 = v11;
v6 = v3;
if( v11 < 0 )
goto LABEL_36;
if( CmpVEEnabled && ((__int64)DmaAdapter[0]->DmaOperations->MapTransferEx & 0x1000000) != 0 )
{
LABEL_34:
v43 = *(_OWORD *)Src;
v11 = CmDeleteValueKey(DmaAdapter[0], (unsigned __int16 *)&v43, (unsigned __int64)Handle, (v33 & 4) != 0);
v28 = v11;
LABEL_35:
v6 = v3;
LABEL_36:
v20 = v27;
goto LABEL_37;
}
v11 = -1073741790;
LABEL_70:
v28 = v11;
goto LABEL_35;
}
v11 = -1073741790;
}
v28 = v11;
v6 = v3;
v19 = 0;
v20 = 0;
LABEL_37:
if( v6 )
SeReleaseSubjectContext(&SubjectContext);
if( v20 )
{
v11 = CmPostCallbackNotificationEx(
RegNtPostDeleteValueKey,
(SLIST_ENTRY *)DmaAdapter[0],
(unsigned int)v11,
(INT64)Argument,
0i64,
(INT64)a6);
v28 = v11;
}
if( v19 )
{
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v11 = v28;
}
if( DmaAdapter[0] )
HalPutDmaAdapter(DmaAdapter[0]);
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
v26 = Src;
LOBYTE(v26) = 15;
(*(void(__fastcall **)(void **, LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, void **))((char *)&NlsMbCodePageTag
+ 7))(
v26,
v44,
(unsigned int)v11,
0i64,
DmaOperations,
Src);
}
if( Privileges )
CmSiFreeMemory(Privileges);
if( v29 )
{
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v28;
}
return v11;
}Referenced by:
ExpWatchProductTypeWork