CmpSaveBootControlSet
__int64 __fastcall CmpSaveBootControlSet(unsigned __int16 a1){
char v1;
CM_KEY_BODY *v2;
char v3;
CM_KEY_BODY *v4;
_PRIVILEGE_SET *TransientPoolWithTag;
INT64 v6;
int v7;
char v8;
INT8 v9;
INT8 v10;
int v11;
INT64 v12;
INT64 KeyControlBlock;
int v14;
int v15;
int v16;
__int64 v17;
_CM_KEY_CONTROL_BLOCK *v18;
UINT64 KeyHive;
INT64 KeyCell;
_CM_KEY_CONTROL_BLOCK *v21;
unsigned int v22;
UINT64 v23;
INT64 v24;
_CM_KEY_CONTROL_BLOCK *v25;
CHAR v26;
unsigned __int8 *v27;
UINT64 *LengthNeeded;
INT64 CreateOptions;
UINT64 CreateOptionsa;
UINT64 *Disposition;
INT64 v33;
BOOL v34;
int v35;
UINT64 Length;
OBJECT_HANDLE_INFORMATION v37;
UINT64 v38;
VOID *KeyHandle;
OBJECT_HANDLE_INFORMATION HandleInformation[3];
VOID *Handle;
INT64 a4[2];
_OBJECT_ATTRIBUTES ObjectAttributes;
_UNICODE_STRING DestinationString;
_KAPC_STATE ApcState;
_EVENT_DATA_DESCRIPTOR v46;
int *v47;
__int64 v48;
OBJECT_HANDLE_INFORMATION *v49;
__int64 v50;
char v51;
v38 = 0i64;
KeyHandle = 0i64;
memset(HandleInformation, 0, sizeof(HandleInformation));
DestinationString = 0i64;
v1 = 0;
v2 = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
v3 = 0;
Handle = 0i64;
v4 = 0i64;
v37 = 0i64;
TransientPoolWithTag = 0i64;
*(_OWORD *)a4 = 0i64;
LODWORD(Length) = 0;
memset(&ApcState, 0, sizeof(ApcState));
v35 = 0;
CmpInitializeDelayDerefContext(a4);
v34 = CmpAcquireShutdownRundown();
if( !v34 )
{
v7 = -1073741431;
goto LABEL_36;
}
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSet;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v7 = ZwOpenKey(
&KeyHandle,
0x20019ui64,
&ObjectAttributes,
v6,
(INT64)LengthNeeded,
CreateOptions,
(INT64)Disposition,
v33);
if( v7 >= 0 )
{
if( ZwQuerySecurityObject((UINT64)KeyHandle, 4i64, 0i64, 0i64, (UINT64)&Length) == -1073741789 )
{
TransientPoolWithTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithTag(1ui64, (unsigned int)Length);
if( TransientPoolWithTag )
{
if( ZwQuerySecurityObject(
(UINT64)KeyHandle,
4i64,
(UINT64)TransientPoolWithTag,
(unsigned int)Length,
(UINT64)&Length) < 0 )
{
CmSiFreeMemory(TransientPoolWithTag);
TransientPoolWithTag = 0i64;
}
}
}
DestinationString.MaximumLength = 256;
DestinationString.Buffer = (wchar_t *)&v51;
RtlUnicodeStringPrintf(&DestinationString, (WCHAR *)L"\\Registry\\Machine\\System\\ControlSet%03d");
v8 = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Attributes = 576;
LODWORD(CreateOptionsa) = 0;
ObjectAttributes.SecurityDescriptor = TransientPoolWithTag;
ObjectAttributes.SecurityQualityOfService = 0i64;
v7 = ZwCreateKey(&Handle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsa, &v38);
if( TransientPoolWithTag )
CmSiFreeMemory(TransientPoolWithTag);
if( v7 >= 0 )
{
v7 = CmObReferenceObjectByHandle(KeyHandle, 0x20019ui64, v9, 0i64, HandleInformation);
if( v7 >= 0 )
{
v7 = CmObReferenceObjectByHandle(Handle, 0x20006ui64, v10, 0i64, &v37);
if( v7 >= 0 )
{
CmpLockRegistryExclusive();
v2 = (CM_KEY_BODY *)HandleInformation[0];
v11 = CmpPerformKeyBodyDeletionCheck(*(CM_KEY_BODY **)HandleInformation, 0i64);
v4 = (CM_KEY_BODY *)v37;
while( 1 )
{
v7 = v11;
if( v11 < 0 || (v7 = CmpPerformKeyBodyDeletionCheck(v4, 0i64), v7 < 0) )
{
LABEL_27:
v3 = 1;
goto LABEL_36;
}
KeyControlBlock = (INT64)v4->KeyControlBlock;
v14 = CmpTryAcquireKcbIXLocks(KeyControlBlock, 1, v12, (UINT64 *)&HandleInformation[1]);
v7 = v14;
if( v14 == -1073741267 )
{
v8 = 1;
}
else if( v14 < 0 )
{
goto LABEL_27;
}
v15 = CmpPrepareToInvalidateAllHigherLayerKcbs(KeyControlBlock, 0, (__int64)&HandleInformation[1]);
v7 = v15;
if( v15 == -1073741267 )
{
v8 = 1;
}
else if( v15 < 0 )
{
goto LABEL_27;
}
v16 = CmpPrepareForSubtreeInvalidation(KeyControlBlock, (__int64)&HandleInformation[1]);
v7 = v16;
if( v16 != -1073741267 )
{
if( v16 < 0 )
goto LABEL_27;
if( !v8 )
break;
}
CmpLogTransactionAbortedForRollbackPacket(KeyControlBlock, 12, (unsigned int *)&HandleInformation[1], v17);
CmpUnlockRegistry();
v8 = 0;
v7 = CmpAbortRollbackPacket((INT64)&HandleInformation[1]);
if( v7 < 0 )
goto LABEL_36;
CmpRetryBackOff(&v35);
CmpCleanupRollbackPacket((INT64)&HandleInformation[1]);
*(_OWORD *)&HandleInformation[1].HandleAttributes = 0i64;
CmpLockRegistryExclusive();
v11 = CmpPerformKeyBodyDeletionCheck(v2, 0i64);
}
CmpInvalidateAllHigherLayerKcbs(KeyControlBlock, 0, 8i64, (INT64)a4);
CmpInvalidateSubtree(KeyControlBlock, 8i64, (INT64)a4, (_DWORD *)&v38 + 1);
CmpAttachToRegistryProcess(&ApcState);
v1 = 1;
v18 = v2->KeyControlBlock;
KeyHive = (UINT64)v18->KeyHash.KeyHive;
KeyCell = v18->KeyHash.KeyCell;
if( (_DWORD)v38 == 1 )
{
v21 = v4->KeyControlBlock;
v22 = 0;
v23 = (UINT64)v21->KeyHash.KeyHive;
v24 = v21->KeyHash.KeyCell;
}
else
{
v25 = v4->KeyControlBlock;
v22 = 1;
v23 = (UINT64)v25->KeyHash.KeyHive;
v24 = v25->KeyHash.KeyCell;
}
v26 = CmpCopySyncTree(KeyHive, KeyCell, v23, v24, 2, v22);
CmpRebuildKcbCache(v4->KeyControlBlock, (__int64)a4);
v3 = 1;
if( v26 )
v7 = 0;
else
v7 = -1073741492;
goto LABEL_36;
}
v4 = (CM_KEY_BODY *)v37;
}
v2 = (CM_KEY_BODY *)HandleInformation[0];
}
}
LABEL_36:
CmpDrainDelayDerefContext((UINT64 **)a4);
if( v3 )
CmpUnlockRegistry();
if( v1 )
CmpDetachFromRegistryProcess(&ApcState);
CmpCleanupRollbackPacket((INT64)&HandleInformation[1]);
if( v2 )
HalPutDmaAdapter((PADAPTER_OBJECT)v2);
if( v4 )
HalPutDmaAdapter((PADAPTER_OBJECT)v4);
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
if( Handle )
ZwClose((_HANDLE)Handle);
if( v34 )
CmpReleaseShutdownRundown();
if( v7 < 0 )
{
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v35 = v7;
v27 = (unsigned __int8 *)word_1400219AA;
goto LABEL_57;
}
}
else if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v27 = (unsigned __int8 *)&byte_1400219EF;
v35 = HIDWORD(v38);
LABEL_57:
v37 = (OBJECT_HANDLE_INFORMATION)0x1000000i64;
v48 = 4i64;
v47 = &v35;
v50 = 8i64;
v49 = &v37;
tlgWriteTransfer_EtwWriteTransfer((__int64)&stru_140C00F40 + 4592, v27, 0i64, 0i64, 4u, &v46);
}
return(unsigned int)v7;
}Referenced by:
CmpAcceptBoot