NtReplaceKey
NTSTATUS __stdcall NtReplaceKey(_OBJECT_ATTRIBUTES *NewFile, VOID *TargetHandle, _OBJECT_ATTRIBUTES *OldFile){
char v3;
char PreviousMode;
_ETHREAD *CurrentThread;
UINT8 v9;
NTSTATUS v10;
_ETHREAD *v11;
INT8 v12;
PVOID *v13;
NTSTATUS v14;
__int64 v15;
INT64 v16;
PADAPTER_OBJECT v17;
int v18;
unsigned int v19;
NTSTATUS v21;
PADAPTER_OBJECT DmaAdapter;
INT64 a6[2];
_LOOKASIDE_LIST_EX P;
_EVENT_DATA_DESCRIPTOR v25;
int *v26;
__int64 v27;
$4290DA71080BA5C562B380EC38D3C295 *v28;
__int64 v29;
_EVENT_DATA_DESCRIPTOR v30;
unsigned int *p_Tag;
__int64 v32;
DmaAdapter = 0i64;
v3 = 0;
PreviousMode = KeGetCurrentThread()->PreviousMode;
a6[1] = (INT64)a6;
a6[0] = (INT64)a6;
memset(&P, 0, 32);
memset(&P.L.48, 0, 48);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v9 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
if( v9 )
{
v10 = CmCheckNoTxContext();
if( v10 >= 0 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, PreviousMode) )
{
v11 = (_ETHREAD *)KeGetCurrentThread();
--v11->Tcb.KernelApcDisable;
v3 = 1;
v10 = CmpNameFromAttributes(NewFile, PreviousMode, (UNICODE_STRING *)&P.L.Depth);
if( v10 >= 0 )
{
v10 = CmpNameFromAttributes(OldFile, PreviousMode, (UNICODE_STRING *)&P);
if( v10 >= 0 )
{
LOBYTE(v13) = PreviousMode;
v14 = CmObReferenceObjectByHandle(TargetHandle, 0i64, v12, v13, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
v17 = DmaAdapter;
v10 = v14;
if( v14 >= 0 )
{
if( (LODWORD(DmaAdapter->AdapterObject.DmaHeader.DmaOperations->PutDmaAdapter) & 0x80u) == 0 )
{
if( !dword_140C5083C
|| ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v15, v16)
|| (P.L.AllocateEx = (void *(__fastcall *)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *))v17,
P.L.FreeEx = (void(__fastcall *)(void *, _LOOKASIDE_LIST_EX *))&P,
P.L.ListEntry.Flink = (_LIST_ENTRY *)&P.L.Depth,
v18 = CmpCallCallBacksEx(
RegNtPreReplaceKey,
(SLIST_ENTRY **)&P.L.48,
0i64,
1,
RegNtPostReplaceKey,
0i64,
(INT64)a6),
v10 = v18,
v18 >= 0) )
{
v19 = CmReplaceKey(
(INT64)v17->AdapterObject.DmaHeader.DmaOperations->AllocateAdapterChannel,
v15,
(_UNICODE_STRING *)&P.L.Depth,
&P);
v10 = CmPostCallbackNotificationEx(
RegNtPostReplaceKey,
(_SLIST_ENTRY *)v17,
v19,
(INT64)&P.L.48,
0i64,
(INT64)a6);
if( v10 == -1073740541 )
v10 = 0;
}
else if( v18 == -1073740541 )
{
v10 = 0;
}
}
else
{
v10 = -1073741790;
}
}
if( v17 )
HalPutDmaAdapter(v17);
}
}
}
else
{
v10 = -1073741727;
}
}
}
else
{
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v10 = -1073741431;
}
if( P.L.ListHead.Region )
ExFreePoolWithTag((PVOID)P.L.ListHead.Region, 0);
if( *(_QWORD *)&P.L.AllocateMisses )
ExFreePoolWithTag(*(PVOID *)&P.L.AllocateMisses, 0);
if( v3 )
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( v9 )
{
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
if( v10 >= 0 )
{
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
*(_QWORD *)&P.L.Tag = 0x1000000i64;
p_Tag = &P.L.Tag;
v32 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)&dword_140021AD4,
0i64,
0i64,
3u,
&v30);
}
}
else if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v21 = v10;
v26 = &v21;
*(_QWORD *)&P.L.FreeMisses = 0x1000000i64;
v28 = &P.L.32;
v27 = 4i64;
v29 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)byte_140021A98,
0i64,
0i64,
4u,
&v25);
}
return v10;
}Referenced by:
No references.