CmLoadDifferencingKey
NTSTATUS __stdcall CmLoadDifferencingKey(
OBJECT_ATTRIBUTES *TargetKey,
OBJECT_ATTRIBUTES *SourceFile,
UINT64 Flags,
PVOID TrustClassKey,
PVOID Event,
UINT64 DesiredAccess,
PVOID *RootHandle,
PVOID LowerLayerKey,
INT8 PreviousMode){
unsigned int v9;
char v11;
BOOL v12;
int v13;
__int64 v15;
__int64 v16;
int v17;
unsigned __int64 v18;
unsigned __int64 v19;
size_t Length;
_PRIVILEGE_SET *TransientPoolWithQuotaTag;
wchar_t *v22;
INT8 v23;
UINT64 v24;
PVOID *v25;
_ETHREAD *CurrentThread;
_SLIST_ENTRY *v27;
INT64 v28;
INT64 v29;
unsigned int v30;
int v31;
_UNICODE_STRING *p_DestinationString;
PADAPTER_OBJECT v33;
KEVENT *AccessMode;
_KPROCESSOR_MODE AccessModea;
PVOID *ParseContext;
BOOL v37;
char v38;
char v39;
PADAPTER_OBJECT v40;
PVOID BugCheckParameter4;
_UNICODE_STRING *ObjectName;
_UNICODE_STRING DestinationString;
_SLIST_ENTRY *v44;
PADAPTER_OBJECT v45;
PADAPTER_OBJECT v46;
PADAPTER_OBJECT v47;
PADAPTER_OBJECT DmaAdapter;
UINT64 v49;
PPRIVILEGE_SET Privileges;
int v51;
_UNICODE_STRING Source;
PVOID v53;
PVOID v54;
VOID *Handle;
_HANDLE v56[2];
PVOID v57;
INT64 a6[2];
OBJECT_ATTRIBUTES v59;
INT64 a5[2];
__int64 v61;
int v62;
PVOID v63;
PVOID v64;
_HANDLE v65[2];
_UNICODE_STRING v66;
_SLIST_ENTRY *Argument[12];
INT64 v68[38];
char UserEvent;
__int64 v70;
CHAR PreviousModea;
v63 = TrustClassKey;
v9 = Flags;
DmaAdapter = (PADAPTER_OBJECT)SourceFile;
v51 = Flags;
*(_QWORD *)v56 = Event;
v44 = (_SLIST_ENTRY *)RootHandle;
v64 = (PVOID)PreviousMode;
*(_QWORD *)v65 = v70;
memset(&v59, 0, sizeof(v59));
DestinationString = 0i64;
Source = 0i64;
ObjectName = 0i64;
Handle = 0i64;
v38 = 0;
v62 = 0;
v11 = 0;
RtlInitUnicodeString(&DestinationString, 0i64);
v39 = 0;
RtlInitUnicodeString(&Source, 0i64);
v40 = 0i64;
BugCheckParameter4 = 0i64;
v47 = 0i64;
v49 = 0i64;
v46 = 0i64;
Privileges = 0i64;
memset(v68, 0i64, 0x128u);
LODWORD(v68[12]) = -1;
v68[19] = (INT64)&v68[18];
v68[18] = (INT64)&v68[18];
memset(&v68[27], 0i64, 0x50u);
v45 = 0i64;
v12 = CmpAcquireShutdownRundown();
v37 = v12;
if( v12 )
{
if( (v9 & 0xFFFF000B) != 0 || PreviousMode && (v9 & 0xFFFF9EFF) != 0 )
goto LABEL_113;
if( !UserEvent )
goto LABEL_5;
if( PreviousMode )
{
if( (v9 & 0x4000) == 0 )
{
LABEL_113:
v13 = -1073741583;
goto LABEL_13;
}
LABEL_5:
if( (v9 & 0x1000) != 0 && (v9 & 0x600) != 1536 )
goto LABEL_113;
v13 = CmCheckNoTxContext();
if( v13 < 0 )
goto LABEL_13;
if( (v9 & 0x10) == 0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, PreviousModea) )
{
v13 = -1073741727;
goto LABEL_12;
}
if( (v9 & 0x810) != 0 )
{
if( v44 )
{
if( (v9 & 0x444) != 0 && (v9 & 0x10) != 0 )
{
v13 = -1073741583;
goto LABEL_12;
}
LABEL_41:
v13 = CmpNameFromAttributes((OBJECT_ATTRIBUTES *)DmaAdapter, PreviousModea, &Source);
if( v13 >= 0 )
{
if( PreviousModea == 1 )
{
if( ((unsigned __int8)TargetKey & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (v9 & 0x810) != 0 )
{
v15 = (__int64)v44;
if( (unsigned __int64)v44 >= 0x7FFFFFFF0000i64 )
v15 = 0x7FFFFFFF0000i64;
*(_QWORD *)v15 = 0i64;
}
}
v59 = *TargetKey;
if( (v9 & 0x10) != 0 && v59.RootDirectory )
{
v13 = -1073741585;
goto LABEL_13;
}
if( PreviousModea == 1 )
{
v66 = 0i64;
v16 = (__int64)v59.ObjectName;
if( v59.ObjectName >= (_UNICODE_STRING *)0x7FFFFFFF0000i64 )
v16 = 0x7FFFFFFF0000i64;
v17 = *(_DWORD *)v16;
*(_DWORD *)&v66.Length = v17;
v18 = *(_QWORD *)(v16 + 8);
v66.Buffer = (wchar_t *)v18;
DestinationString = v66;
if( (_WORD)v17 )
{
if( (v18 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v19 = v18 + (unsigned __int16)v17;
if( v19 > 0x7FFFFFFF0000i64 || v19 < v18 )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
DestinationString = *TargetKey->ObjectName;
}
Length = DestinationString.Length;
if( DestinationString.Length )
{
TransientPoolWithQuotaTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithQuotaTag(
0x7FFFFFFF0000i64,
DestinationString.Length,
0x6B624D43ui64);
Privileges = TransientPoolWithQuotaTag;
if( !TransientPoolWithQuotaTag )
{
v13 = -1073741670;
v11 = 0;
goto LABEL_13;
}
v22 = (wchar_t *)TransientPoolWithQuotaTag;
memmove(TransientPoolWithQuotaTag, DestinationString.Buffer, Length);
DestinationString.Length = Length;
DestinationString.MaximumLength = Length;
DestinationString.Buffer = v22;
v11 = 0;
}
else
{
RtlInitUnicodeString(&DestinationString, 0i64);
}
v59.ObjectName = &DestinationString;
v59.SecurityDescriptor = 0i64;
if( !v63
|| (AccessMode = 0i64,
LOBYTE(v25) = PreviousModea,
v13 = CmObReferenceObjectByHandle(v63, 0i64, v24, v25, (OBJECT_HANDLE_INFORMATION *)&v40),
v13 >= 0) )
{
if( !*(_QWORD *)v56
|| (v57 = 0i64,
v13 = ObReferenceObjectByHandle(
*(VOID **)v56,
2ui64,
(_OBJECT_TYPE *)ExEventObjectType,
PreviousModea,
&v57,
0i64),
v46 = (PADAPTER_OBJECT)v57,
v13 >= 0) )
{
if( !v64
|| (AccessMode = 0i64,
LOBYTE(v25) = PreviousModea,
v13 = CmObReferenceObjectByHandle(v64, 0i64, v24, v25, (OBJECT_HANDLE_INFORMATION *)&v47),
v13 >= 0) )
{
if( *(_QWORD *)v65 )
{
v53 = 0i64;
v13 = ObReferenceObjectByHandle(
*(VOID **)v65,
4ui64,
(_OBJECT_TYPE *)SeTokenObjectType,
PreviousModea,
&v53,
0i64);
v45 = (PADAPTER_OBJECT)v53;
if( v13 < 0 )
goto LABEL_12;
if( *((_DWORD *)v53 + 48) != 2 )
{
v13 = -1073741656;
goto LABEL_12;
}
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v39 = 1;
LOBYTE(v24) = PreviousModea;
v13 = CmConvertHandleToKernelHandle(v59.RootDirectory, v23, v24, (PVOID *)0x20019);
if( v13 >= 0 )
{
v59.RootDirectory = (void *)v49;
v27 = 0i64;
memset(Argument, 0i64, sizeof(Argument));
*(_OWORD *)a5 = 0i64;
v61 = 0i64;
a6[1] = (INT64)a6;
a6[0] = (INT64)a6;
if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v28, v29) )
{
if( v59.RootDirectory )
{
v54 = 0i64;
ObReferenceObjectByHandle(
v59.RootDirectory,
0i64,
(_OBJECT_TYPE *)CmKeyObjectType,
0,
&v54,
0i64);
v27 = (_SLIST_ENTRY *)v54;
}
Argument[10] = (_SLIST_ENTRY *)2;
Argument[0] = v27;
Argument[1] = (_SLIST_ENTRY *)&DestinationString;
Argument[2] = (_SLIST_ENTRY *)&Source;
LODWORD(Argument[3]) = v9;
Argument[4] = (_SLIST_ENTRY *)v40;
Argument[5] = (_SLIST_ENTRY *)v46;
LODWORD(Argument[6]) = DesiredAccess;
Argument[7] = v44;
Argument[11] = (_SLIST_ENTRY *)v45;
a5[0] = (INT64)Argument;
a5[1] = (INT64)v47;
LOBYTE(v61) = UserEvent;
v13 = CmpCallCallBacksEx(
RegNtPreLoadKey,
Argument,
(INT64)a5,
1,
RegNtPostLoadKey,
0i64,
(INT64)a6);
}
if( v13 < 0 )
{
if( v13 == -1073740541 )
{
v13 = 0;
v38 = 1;
}
}
else
{
CmpTraceHiveLoadStart(&Source.Length, v9);
v11 = 1;
if( (v9 & 0x10) != 0 )
{
CmpReleaseShutdownRundown();
v37 = 0;
LOBYTE(ParseContext) = PreviousModea;
v30 = CmLoadAppKey(
&v59,
&Source,
v9,
(CM_KEY_BODY *)v40,
(KEVENT *)v46,
(UNICODE_STRING **)v45,
ParseContext);
}
else
{
LOBYTE(AccessMode) = UserEvent;
v30 = CmLoadKey(
&v59,
&Source,
v9,
(CM_KEY_BODY *)v40,
(CM_KEY_BODY *)v47,
AccessMode,
(UNICODE_STRING **)v46,
(PVOID *)v45);
}
v13 = CmPostCallbackNotificationEx(
RegNtPostLoadKey,
v27,
v30,
(INT64)Argument,
(INT64)a5,
(INT64)a6);
}
if( v27 )
HalPutDmaAdapter((PADAPTER_OBJECT)v27);
if( v40 )
{
HalPutDmaAdapter(v40);
v40 = 0i64;
}
if( v13 >= 0 && (v9 & 0x810) != 0 && !v38 )
{
DmaAdapter = 0i64;
v31 = v68[0];
if( (v9 & 0x10) != 0 )
v31 = 64;
LODWORD(v68[0]) = v31;
p_DestinationString = &DestinationString;
if( ObjectName )
p_DestinationString = ObjectName;
ObjectName = p_DestinationString;
v13 = ObReferenceObjectByName(
p_DestinationString,
0x40ui64,
0i64,
0i64,
(_OBJECT_TYPE *)CmKeyObjectType,
0,
v68,
(VOID **)&DmaAdapter);
if( v13 >= 0 )
{
v33 = DmaAdapter;
ObDeleteCapturedInsertInfo((INT64)DmaAdapter);
LOBYTE(AccessModea) = PreviousModea;
v13 = ObOpenObjectByPointer(
v33,
PreviousModea != 0 ? 64 : 576,
0i64,
DesiredAccess,
(POBJECT_TYPE)CmKeyObjectType,
AccessModea,
&Handle);
HalPutDmaAdapter(v33);
if( v13 >= 0 )
v44->Next = (_SLIST_ENTRY *)Handle;
}
if( BugCheckParameter4 )
{
if( (v9 & 0x10) != 0 )
{
CmReleaseLoadKeyContext(BugCheckParameter4, v13);
}
else
{
CmpLockRegistry();
CmpDereferenceKeyControlBlock((UINT64)BugCheckParameter4);
CmpUnlockRegistry();
}
BugCheckParameter4 = 0i64;
}
if( v13 < 0 && (v9 & 0x800) != 0 )
v13 = 0;
}
}
}
}
}
}
LABEL_12:
v12 = v37;
goto LABEL_13;
}
}
else if( !v44 )
{
if( *(_QWORD *)v56 )
{
v13 = -1073741581;
goto LABEL_12;
}
goto LABEL_41;
}
v13 = -1073741579;
goto LABEL_12;
}
v13 = -1073741576;
}
else
{
v13 = -1073741431;
}
LABEL_13:
if( BugCheckParameter4 )
CmReleaseLoadKeyContext(BugCheckParameter4, v13);
if( ObjectName && ObjectName != &DestinationString )
CmpFreeTransientPoolWithTag(ObjectName, 0x624E4D43ui64);
if( v49 )
ZwClose(v49);
if( v39 )
KeLeaveCriticalRegion();
if( v45 )
HalPutDmaAdapter(v45);
if( v47 )
HalPutDmaAdapter(v47);
if( v46 )
HalPutDmaAdapter(v46);
if( v40 )
HalPutDmaAdapter(v40);
if( Privileges )
CmSiFreeMemory(Privileges);
if( Source.Buffer )
ExFreePoolWithTag(Source.Buffer, 0);
CmpCleanupParseContext((INT64)v68, 0);
if( v12 )
CmpReleaseShutdownRundown();
if( v11 )
CmpTraceHiveLoadStop(v13);
return v13;
}Referenced by:
NtLoadKey2
NtLoadKey3
NtLoadKeyEx
VrpLoadDifferencingHive
VrpPreLoadKey