NtCreateRegistryTransaction

NTSTATUS __stdcall NtCreateRegistryTransaction(
        VOID **TransactionHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 CreateOptions){
  int v4; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  UINT64 v9; 
  UINT8 v10; 
  UINT64 v11; 
  char PreviousMode; 
  __int64 v13; 
  int inserted; 
  _QWORD *v15; 
  VOID *v17; 
  VOID *v18; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 v21; 
  PVOID v22; 
  PVOID Object; 

  v4 = CreateOptions;
  v6 = DesiredAccess;
  Object = 0i64;
  v22 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v10 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  if( !v10 )
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v10 )
  {
    if( v4 )
    {
      inserted = -1073741811;
    }
    else
    {
      PreviousMode = KeGetCurrentThread()->PreviousMode;
      if( PreviousMode == 1 )
      {
        v13 = 0x7FFFFFFF0000i64;
        if( (unsigned __int64)TransactionHandle < 0x7FFFFFFF0000i64 )
          v13 = (__int64)TransactionHandle;
        *(_QWORD *)v13 = 0i64;
      }
      else
      {
        *TransactionHandle = 0i64;
      }
      LODWORD(v21) = 0;
      LODWORD(Handle) = 0;
      LODWORD(ObjectBodySize) = 24;
      LOBYTE(v11) = PreviousMode;
      LOBYTE(v9) = PreviousMode;
      inserted = ObCreateObjectEx(
                   v9,
                   *(&CmpDummyThreadEvent + 6),
                   ObjectAttributes,
                   v11,
                   v17,
                   ObjectBodySize,
                   (UINT64)Handle,
                   v21,
                   &Object,
                   0i64);
      if( inserted >= 0 )
      {
        v15 = Object;
        *(_OWORD *)Object = 0i64;
        v15[2] = 0i64;
        v15[1] = 0i64;
        LODWORD(v18) = 0;
        inserted = ObInsertObjectEx(v15, 0i64, v6, 0i64, (UINT64)v18, 0i64, &v22);
        Object = 0i64;
        if( inserted >= 0 )
        {
          *TransactionHandle = v22;
          v22 = 0i64;
          inserted = 0;
        }
      }
    }
  }
  else
  {
    inserted = -1073741431;
  }
  if( v22 )
    NtClose((UINT64)v22);
  if( Object )
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  if( v10 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return inserted;
}

Referenced by: