CmQueryKey
__int64 __fastcall CmQueryKey(__int64 a1, __int64 a2, int a3, unsigned int *a4, unsigned int a5, unsigned int *a6){
CM_TRANS *v10;
_CM_KEY_CONTROL_BLOCK *v11;
_CM_KEY_CONTROL_BLOCK *v12;
int KeyData;
_UNICODE_STRING *p_UnicodeString;
unsigned int v15;
unsigned int *v16;
size_t v17;
__int64 v18;
INT64 v19;
int v20;
__int32 bf_b8;
unsigned int v22;
unsigned int v23;
int v24;
_ETHREAD *CurrentThread;
_EPROCESS *CurrentThreadProcess;
int v27;
__int64 v28;
bool v29;
unsigned int v30;
unsigned int v31;
int v32;
unsigned int v33;
int v34;
__int64 v35;
NTSTATUS v37;
unsigned int LayeredKey;
_DWORD v39[3];
unsigned int v40;
unsigned int *v41;
VOID *P;
CM_TRANS *CmTrans[2];
unsigned int v44;
unsigned int v45;
unsigned int *v46;
unsigned int *v47;
_UNICODE_STRING UnicodeString;
_CM_KEY_CONTROL_BLOCK *v49;
__int64 v50;
UINT64 *RegLockHeldEx[2];
__int64 v52;
__int64 v53;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
__int128 v55;
__int128 v56;
__int128 v57;
_KAPC_STATE ApcState;
v41 = a4;
CmTrans[1] = (CM_TRANS *)a1;
v50 = a1;
*(_QWORD *)&v39[1] = a2;
v46 = a4;
v47 = a6;
P = 0i64;
v10 = 0i64;
CmTrans[0] = 0i64;
UnicodeString = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
*(_OWORD *)RegLockHeldEx = 0i64;
CmpInitializeDelayDerefContext(RegLockHeldEx);
CmpAttachToRegistryProcess(&ApcState);
CmpLockRegistry();
v11 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
v49 = v11;
if( v11->LayerHeight )
{
LayeredKey = CmQueryLayeredKey(a1, a3, a4, a5, a6);
CmpUnlockRegistry();
CmpDetachFromRegistryProcess(&ApcState);
return LayeredKey;
}
else
{
if( !*(_QWORD *)(a1 + 56) && !*(_QWORD *)(a1 + 64) )
{
LABEL_4:
if( a2 )
{
v11 = *(_CM_KEY_CONTROL_BLOCK **)(a2 + 8);
v49 = v11;
}
if( a2 )
CmpLockTwoKcbsShared(*(_CM_KEY_CONTROL_BLOCK **)(a2 + 8), *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8));
else
CmpLockKcbShared(*(_CM_KEY_CONTROL_BLOCK **)(a1 + 8));
if( a3 != 3 )
{
if( a2 && CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a2, v10)
|| CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, v10) )
{
v24 = -1073741444;
if( (*(_BYTE *)(a1 + 48) & 1) != 0 )
v24 = -1073740763;
KeyData = v24;
goto LABEL_104;
}
switch( a3 )
{
case 5:
*a6 = 12;
if( a5 < 0xC )
{
KeyData = -1073741789;
}
else
{
*a4 = CmGetKeyFlags((__int64)v11, (__int64)v10, v19);
a4[1] = 0;
v20 = 0;
if( (v11->KeyHash.KeyCell & 0x80000000) != 0 )
{
v20 = 1;
a4[1] = 1;
}
bf_b8 = v11->_bf_b8;
if( (bf_b8 & 0x100000) != 0 )
{
a4[1] = v20 | 2;
bf_b8 = v11->_bf_b8;
}
a4[2] = (unsigned __int8)bf_b8 >> 4;
KeyData = 0;
}
v16 = v41;
break;
case 6:
memset(&SubjectContext, 0, sizeof(SubjectContext));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
SeCaptureSubjectContextEx(CurrentThread, CurrentThreadProcess, &SubjectContext);
v27 = 4;
*a6 = 4;
if( a5 >= 4 )
{
v28 = (__int64)v49;
v29 = KCBNeedsVirtualImage_0((__int64)v49);
v16 = v41;
v30 = v29 | *v41 & 0xFFFFFFFE;
*v41 = v30;
v31 = v30 & 0xFFFFFFFD;
*v16 = v31;
v32 = v31;
if( v29 && (*(_DWORD *)(v28 + 184) & 0x20) == 0 )
{
v32 = v31 | 2;
*v16 = v31 | 2;
}
if( !CmpVEEnabled || (*(_DWORD *)(v28 + 184) & 0x1000000) == 0 )
v27 = 0;
v33 = v27 | v32 & 0xFFFFFFFB;
*v16 = v33;
v34 = v33 ^ ((unsigned __int8)v33 ^ (unsigned __int8)(*(_DWORD *)(v28 + 184) >> 22)) & 8;
*v16 = v34;
*v16 = v34 ^ ((unsigned __int8)v34 ^ (unsigned __int8)(*(_DWORD *)(v28 + 184) >> 19)) & 0x10;
KeyData = 0;
}
else
{
KeyData = -1073741789;
v16 = v41;
}
SeReleaseSubjectContext(&SubjectContext);
v10 = CmTrans[0];
break;
case 8:
*a6 = 4;
if( a5 >= 4 )
{
v22 = *a4;
if( (v11->KeyHash.KeyHive[2].Storage[1].FreeDisplay[6].RealVectorSize & 1) != 0 )
v23 = v22 & 0xFFFFFFFE;
else
v23 = v22 | 1;
*a4 = v23;
KeyData = 0;
v16 = v41;
LABEL_25:
if( a2 )
{
if( ((a3 - 3) & 0xFFFFFFFC) != 0 || a3 == 4 )
{
v35 = *(_QWORD *)(*(_QWORD *)(a2 + 8) + 168i64);
if( *(_QWORD *)(*(_QWORD *)(a1 + 8) + 168i64) < v35 )
*(_QWORD *)v16 = v35;
}
if( ((a3 - 2) & 0xFFFFFFFD) == 0 )
{
v39[0] = 0;
v52 = 0i64;
v44 = 0;
v55 = 0i64;
v56 = 0i64;
v57 = 0i64;
if( (unsigned int)CmpFindSubKeyByNumberFromMergedView(
*(_QWORD *)(a2 + 8),
*(_QWORD *)(a1 + 8),
0xFFFFFFFFi64,
(__int64)v10,
(__int64)RegLockHeldEx,
&v52,
&v44,
0i64,
v39) == -2147483622 )
{
if( a3 == 2 )
v16[5] = v39[0];
else
v16[3] = v39[0];
}
if( (unsigned int)CmEnumerateValueKeyFromMergedView(
a1,
a2,
1,
0xFFFFFFFF,
0,
0i64,
0,
0i64,
(__int64)v39) == -2147483622 )
{
if( a3 == 2 )
v16[8] = v39[0];
else
v16[5] = v39[0];
}
KeyData = CmpQueryKeyData(*(_QWORD *)(a1 + 8), a3, (__int64)&v55, 0x30u, a6, (__int64)v10);
if( (int)(KeyData + 0x80000000) < 0 || KeyData == -2147483643 )
{
if( a3 == 2 )
{
if( DWORD2(v56) > v16[6] )
v16[6] = DWORD2(v56);
if( DWORD1(v57) > v16[9] )
v16[9] = DWORD1(v57);
if( DWORD2(v57) > v16[10] )
v16[10] = DWORD2(v57);
}
else
{
if( (unsigned int)v56 > v16[4] )
v16[4] = v56;
if( DWORD2(v56) > v16[6] )
v16[6] = DWORD2(v56);
if( HIDWORD(v56) > v16[7] )
v16[7] = HIDWORD(v56);
}
}
}
}
else if( CmpVEEnabled )
{
v18 = *(_QWORD *)(a1 + 8);
if( (*(_DWORD *)(v18 + 184) & 0x1000000) != 0 && ((a3 - 2) & 0xFFFFFFFD) == 0 )
{
v40 = 0;
v53 = 0i64;
v45 = 0;
KeyData = CmpFindSubKeyByNumberFromMergedView(
v18,
0i64,
0xFFFFFFFFi64,
(__int64)v10,
(__int64)RegLockHeldEx,
&v53,
&v45,
0i64,
&v40);
if( KeyData == -2147483622 )
{
if( a3 == 2 )
v16[5] = v40;
else
v16[3] = v40;
KeyData = 0;
}
}
}
goto LABEL_104;
}
KeyData = -1073741789;
LABEL_104:
if( a2 )
CmpUnlockTwoKcbs(*(_CM_KEY_CONTROL_BLOCK **)(a2 + 8), *(_CM_KEY_CONTROL_BLOCK **)(v50 + 8));
else
CmpUnlockKcb(*(_CM_KEY_CONTROL_BLOCK **)(v50 + 8));
CmpDrainDelayDerefContext(RegLockHeldEx);
CmpUnlockRegistry();
CmpDetachFromRegistryProcess(&ApcState);
if( UnicodeString.Buffer )
{
RtlFreeAnsiString(&UnicodeString);
}
else if( P )
{
CmpFreeTransientPoolWithTag(P, 0x624E4D43ui64);
}
return(unsigned int)KeyData;
default:
KeyData = CmpQueryKeyData((__int64)v11, a3, (__int64)a4, a5, a6, (__int64)v10);
v16 = v41;
break;
}
LABEL_24:
if( KeyData >= 0 )
goto LABEL_25;
goto LABEL_104;
}
v12 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, v10) )
{
if( (*(_DWORD *)(a1 + 48) & 1) != 0 )
{
KeyData = -1073740763;
goto LABEL_104;
}
KeyData = -1073741444;
}
else
{
KeyData = 0;
}
if( !v12->NameBlock )
{
LABEL_58:
KeyData = -1073741670;
goto LABEL_104;
}
if( CmpVEEnabled && (v12->_bf_b8 & 0x1000000) != 0 )
{
if( (int)CmVirtualKCBToRealPath((__int64)v12, &UnicodeString) < 0 )
{
LABEL_16:
if( P )
{
v15 = *(unsigned __int16 *)P;
*a6 = v15 + 4;
v16 = v41;
if( a5 < 4 )
{
KeyData = -1073741789;
}
else
{
*v41 = v15;
v17 = a5 - 4;
if( a5 - 4 < v15 )
KeyData = -2147483643;
if( v17 >= v15 )
v17 = v15;
memmove(v16 + 1, *((const VOID **)P + 1), v17);
}
goto LABEL_24;
}
goto LABEL_58;
}
p_UnicodeString = &UnicodeString;
}
else
{
p_UnicodeString = CmpConstructName(v12);
}
P = p_UnicodeString;
goto LABEL_16;
}
CmpLockKcbShared(v11);
if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) )
{
KeyData = -1073740763;
if( (*(_DWORD *)(a1 + 48) & 1) == 0 )
KeyData = -1073741444;
CmpUnlockKcb(v11);
CmpUnlockRegistry();
CmpDetachFromRegistryProcess(&ApcState);
return(unsigned int)KeyData;
}
CmpUnlockKcb(v11);
v37 = CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)a1, CmTrans);
if( v37 >= 0 )
{
v10 = CmTrans[0];
goto LABEL_4;
}
CmpUnlockRegistry();
CmpDetachFromRegistryProcess(&ApcState);
return(unsigned int)v37;
}
}Referenced by:
NtQueryKey