CmpParseKey
INT64 __stdcall CmpParseKey(
VOID *ParseObject,
VOID *ObjectType,
ACCESS_STATE *AccessState,
INT8 AccessMode,
UINT64 Attributes,
UNICODE_STRING *CompleteName,
UNICODE_STRING *RemainingName,
VOID *Context,
SECURITY_QUALITY_OF_SERVICE *SecurityQos,
VOID **Object){
__int64 v10;
_SLIST_ENTRY *RegistryNamespaceRootForSilo;
char *v12;
ACCESS_STATE *v13;
_UNICODE_STRING v14;
PPRIVILEGE_SET v15;
VOID **v16;
unsigned __int16 Length;
wchar_t *Buffer;
unsigned __int16 MaximumLength;
int v20;
INT64 v21;
INT64 v22;
_ETHREAD *CurrentThread;
_SLIST_ENTRY *v24;
__int64 v25;
int v26;
int v27;
unsigned int i;
int v29;
__int64 v30;
ACCESS_STATE *v31;
_SLIST_ENTRY *v32;
int v33;
bool v35;
_PRIVILEGE_SET *TransientPoolWithTag;
__int64 v37;
int v38;
_UNICODE_STRING v39;
PADAPTER_OBJECT v40;
INT64 a5[2];
char *v42;
INT64 a6[2];
PPRIVILEGE_SET Privileges;
__int16 v45[2];
int v46;
__int64 v47;
_SLIST_ENTRY *Argument[2];
__int128 v49;
__int128 v50;
__int128 v51;
__int128 v52;
__int128 v53;
__int128 v54;
__int128 v55;
__int64 v56;
_UNICODE_STRING v57;
char v58;
int v59;
ACCESS_STATE *v60;
INT8 v61;
_QWORD *v62;
v61 = AccessMode;
v60 = AccessState;
v10 = (__int64)v62;
RegistryNamespaceRootForSilo = (_SLIST_ENTRY *)ParseObject;
v12 = (char *)Context;
v57 = 0i64;
v13 = AccessState;
v58 = 0;
v14 = *RemainingName;
*v62 = 0i64;
v15 = 0i64;
v56 = 0i64;
v42 = 0i64;
a6[1] = (INT64)a6;
v39 = v14;
a6[0] = (INT64)a6;
v40 = 0i64;
Privileges = 0i64;
*(_OWORD *)Argument = 0i64;
LODWORD(RemainingName) = 0;
v49 = 0i64;
v59 = 0;
v50 = 0i64;
v51 = 0i64;
v52 = 0i64;
v53 = 0i64;
v54 = 0i64;
v55 = 0i64;
*(_OWORD *)a5 = 0i64;
if( ObjectType != CmKeyObjectType )
return 3221225508i64;
v16 = Object;
if( ParseObject == CmpRegistryRootObject )
RegistryNamespaceRootForSilo = (_SLIST_ENTRY *)CmpGetRegistryNamespaceRootForSilo((EJOB *)Object[1]);
Length = v39.Length;
if( v39.Length )
{
Buffer = v39.Buffer;
while( v39.Buffer[((unsigned __int64)Length >> 1) - 1] == 92 )
{
v35 = Length == 2;
Length -= 2;
v39.Length = Length;
if( v35 )
goto LABEL_10;
}
if( Length )
{
MaximumLength = v39.MaximumLength;
do
{
if( *Buffer != 92 )
break;
++Buffer;
Length -= 2;
MaximumLength -= 2;
v39.Buffer = Buffer;
v39.Length = Length;
v39.MaximumLength = MaximumLength;
}
while( Length );
}
}
LABEL_10:
if( !v12 )
{
TransientPoolWithTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithTag(1ui64, 0x128ui64);
Privileges = TransientPoolWithTag;
v15 = TransientPoolWithTag;
if( !TransientPoolWithTag )
return 3221225626i64;
memset(TransientPoolWithTag, 0i64, 0x128u);
v15[4].Privilege[0].Attributes = -1;
*(_QWORD *)&v15[7].Privilege[0].Luid.HighPart = (char *)v15 + 144;
*(_QWORD *)&v15[7].Control = (char *)v15 + 144;
memset(&v15[10].Privilege[0].Attributes, 0i64, 0x50u);
v12 = (char *)v15;
}
v20 = *((_DWORD *)v16 + 1) & (__int64)RegistryNamespaceRootForSilo[6].Next;
*((_DWORD *)v12 + 24) = v20;
if( CmpDoesParseEnterRegistryA((_CM_KEY_BODY *)RegistryNamespaceRootForSilo, &v39) && (*(_DWORD *)v12 & 0x40) == 0 )
{
v27 = -1073741790;
goto LABEL_38;
}
if( (*(_DWORD *)v12 & 0x800) != 0 && !CmpDoesParseEnterRegistryA((_CM_KEY_BODY *)RegistryNamespaceRootForSilo, &v39) )
{
v27 = -1073741790;
goto LABEL_38;
}
if( ((__int64)RegistryNamespaceRootForSilo[3].Next & 0x10) != 0 )
*((_DWORD *)v12 + 6) |= 0x10u;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v24 = (_SLIST_ENTRY *)CompleteName;
if( !dword_140C5083C || ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v21, v22) )
goto LABEL_23;
*((_QWORD *)&v54 + 1) = 1i64;
DWORD2(v55) = *((_DWORD *)v12 + 7);
HIDWORD(v55) = Attributes;
*(_QWORD *)&v55 = &v39;
LOBYTE(v56) = v61;
DWORD2(v49) = *((_DWORD *)v12 + 6);
*(_QWORD *)&v49 = CmKeyObjectType;
DWORD2(v51) = *((_DWORD *)v13 + 4);
Argument[0] = v24;
Argument[1] = RegistryNamespaceRootForSilo;
*((_QWORD *)&v52 + 1) = v10;
v25 = *((_QWORD *)v12 + 9);
if( (v25 & 1) != 0 )
v25 = 0i64;
*(_QWORD *)&v54 = v25;
a5[0] = (INT64)Argument;
LODWORD(a5[1]) = *((_DWORD *)v12 + 24);
v42 = v12 + 144;
if( (*(_DWORD *)v12 & 1) != 0 )
{
v45[0] = *((_WORD *)v12 + 2);
v45[1] = v45[0];
v47 = *((_QWORD *)v12 + 1);
*(_QWORD *)&v52 = v12 + 32;
*(_QWORD *)&v50 = v45;
*((_QWORD *)&v50 + 1) = *((_QWORD *)v13 + 8);
*(_QWORD *)&v51 = SecurityQos;
v46 = 0;
v26 = CmpCallCallBacksEx(
RegNtPreCreateKeyEx,
Argument,
(INT64)a5,
1,
RegNtPostCreateKeyEx,
(INT64)RegistryNamespaceRootForSilo,
(INT64)a6);
}
else
{
v26 = CmpCallCallBacksEx(
RegNtPreOpenKeyEx,
Argument,
(INT64)a5,
1,
RegNtPostOpenKeyEx,
(INT64)RegistryNamespaceRootForSilo,
(INT64)a6);
}
v27 = v26;
if( v26 >= 0 )
{
RegistryNamespaceRootForSilo = Argument[1];
v13 = v60;
*((_DWORD *)v12 + 24) = a5[1];
v58 = 1;
LABEL_23:
for( i = (unsigned int)RemainingName; ; ++i )
{
while( 1 )
{
v57 = v39;
v29 = CmpDoParseKey(
(INT64)RegistryNamespaceRootForSilo,
v13,
v61,
Attributes,
(_UNICODE_STRING *)v24,
(INT64 *)&v57,
(INT64)v12,
(INT64)SecurityQos,
&v40);
v27 = v29;
if( v29 != 259 )
break;
KeWaitForSingleObject((UINT64)&stru_140C00F40 + 200 * *((unsigned int *)v12 + 34) + 48, 0, 0, 0, 0i64);
*(_DWORD *)v12 &= ~0x100u;
v13 = v60;
}
if( v29 != -1073741267 )
break;
if( i >= 0x40 )
{
v27 = -1073741772;
break;
}
if( (*((_DWORD *)v12 + 25) & 4) != 0 )
{
CmpRollbackTransactionArray(*((_DWORD *)v12 + 30), *((PADAPTER_OBJECT **)v12 + 16), v30, &v59);
*((_DWORD *)v12 + 25) &= ~4u;
*((_DWORD *)v12 + 30) = 0;
*((_QWORD *)v12 + 16) = 0i64;
}
v13 = v60;
}
v20 = *((_DWORD *)v16 + 1) & (__int64)RegistryNamespaceRootForSilo[6].Next;
if( v27 >= 0 )
{
*(_QWORD *)v10 = v40;
v40 = 0i64;
}
if( v58 )
{
v31 = v60;
v32 = *(_SLIST_ENTRY **)v10;
HIDWORD(v51) = *((_DWORD *)v60 + 5);
v27 = CmPostCallbackNotificationEx(
(_REG_NOTIFY_CLASS)(2 * ((*(_DWORD *)v12 & 1) == 0) + 27),
v32,
(unsigned int)v27,
(INT64)Argument,
(INT64)a5,
(INT64)a6);
if( v27 >= 0 )
{
v33 = HIDWORD(v51);
if( HIDWORD(v51) != *((_DWORD *)v31 + 5) )
{
*((_DWORD *)v31 + 5) = HIDWORD(v51);
*((_DWORD *)v31 + 4) = *((_DWORD *)v31 + 6) & ~(v33 | 0x2000000);
}
}
if( *(_QWORD *)v10 )
*(_DWORD *)(*(_QWORD *)v10 + 96i64) = a5[1];
}
LABEL_34:
if( v27 != 872 )
{
if( v27 == 260 )
{
*((_DWORD *)v12 + 24) = v20;
v16[1] = PsGetCurrentSilo();
}
goto LABEL_37;
}
goto LABEL_50;
}
if( v26 != -1073740541 )
goto LABEL_34;
v27 = HIDWORD(a5[1]);
if( HIDWORD(a5[1]) == 260 )
goto LABEL_34;
if( HIDWORD(a5[1]) != 872 )
{
v37 = (__int64)v60;
v38 = HIDWORD(v51);
*((_DWORD *)v60 + 5) |= HIDWORD(v51);
*(_DWORD *)(v37 + 16) &= ~(v38 | 0x2000000);
v27 = 0;
goto LABEL_37;
}
LABEL_50:
*((_QWORD *)v12 + 8) = 0i64;
v16[1] = 0i64;
LABEL_37:
KeLeaveCriticalRegion();
v15 = Privileges;
LABEL_38:
if( v15 )
{
CmpCleanupParseContext((INT64)v15, 0);
CmSiFreeMemory(v15);
}
return(unsigned int)v27;
}Referenced by:
No references.