VrpPreLoadKey
NTSTATUS __stdcall VrpPreLoadKey(_REG_LOAD_KEY_INFORMATION *LoadInfo, _VRP_JOB_CONTEXT *JobContext){
unsigned int *v4;
_UNICODE_STRING *v5;
_UNICODE_STRING *v6;
NTSTATUS NamespaceNodePlaceholderKey;
_UNICODE_STRING *p_NewPath;
int Length;
__int64 Buffer;
_VRP_JOB_CONTEXT *v11;
_UNICODE_STRING *v12;
int v13;
wchar_t *v14;
_ETHREAD *CurrentThread;
INT64 v16;
VOID *v17;
VOID *v18;
PUNICODE_STRING KeyName;
VOID *v20;
UINT64 v21;
NTSTATUS v22;
PVOID v23;
_UNICODE_STRING *v24;
_UNICODE_STRING *v25;
_UNICODE_STRING *p_Destination;
UINT64 AccessMode;
_KPROCESSOR_MODE AccessModea;
char v30;
int v32;
_UNICODE_STRING Destination;
_UNICODE_STRING NewPath;
_UNICODE_STRING GuidString;
_UNICODE_STRING InputString;
int v37;
int v38;
NTSTATUS v39;
UINT64 Position;
PVOID Object;
_UNICODE_STRING *v42;
INT64 v43;
PVOID TrustClassKey;
PVOID Event;
INT8 Handle[8];
VOID *v47;
_HANDLE v48[2];
_UNICODE_STRING PathToken;
_REG_LOAD_KEY_INFORMATION *v50;
VOID *v51;
PADAPTER_OBJECT DmaAdapter;
_VRP_JOB_CONTEXT *v53;
OBJECT_ATTRIBUTES SourceFile;
OBJECT_ATTRIBUTES TargetKey;
_GUID v56;
_EVENT_DATA_DESCRIPTOR v57;
int *v58;
__int64 v59;
wchar_t *v60;
int v61[2];
int *v62;
__int64 v63;
wchar_t *v64;
int v65[2];
int *v66;
__int64 v67;
_EVENT_DATA_DESCRIPTOR v68;
int *v69;
__int64 v70;
__int64 v71;
int v72[2];
_EVENT_DATA_DESCRIPTOR v73;
int *v74;
__int64 v75;
char v76;
v50 = LoadInfo;
v53 = JobContext;
NewPath = 0i64;
*(_QWORD *)&GuidString.Length = 5111808i64;
memset(&SourceFile, 0, sizeof(SourceFile));
Destination = 0i64;
memset(&TargetKey, 0, sizeof(TargetKey));
InputString = 0i64;
PathToken = 0i64;
v56 = 0i64;
EtwActivityIdControl(3ui64, &v56);
v4 = (unsigned int *)LoadInfo->Object;
GuidString.Buffer = (wchar_t *)&v76;
v30 = 0;
v32 = 0;
v5 = (_UNICODE_STRING *)*((_QWORD *)v4 + 9);
v43 = 0i64;
Position = 0i64;
TrustClassKey = 0i64;
Event = 0i64;
*(_QWORD *)v48 = 0i64;
DmaAdapter = 0i64;
v51 = 0i64;
v6 = 0i64;
v42 = 0i64;
*(_QWORD *)Handle = 0i64;
v47 = 0i64;
if( v5 )
{
NamespaceNodePlaceholderKey = VrpBuildKeyPath(v5 + 1, *((_UNICODE_STRING **)v4 + 1), &NewPath);
if( NamespaceNodePlaceholderKey < 0 )
goto LABEL_53;
v30 = 1;
}
else
{
NewPath = *(_UNICODE_STRING *)*((_QWORD *)v4 + 1);
}
if( *(&stru_140C00F40 + 1162) > 5u )
{
p_NewPath = &NewPath;
if( !NewPath.Buffer )
p_NewPath = (_UNICODE_STRING *)&EmptyUnicodeString;
Length = p_NewPath->Length;
Buffer = (__int64)p_NewPath->Buffer;
v69 = v72;
v70 = 2i64;
v71 = Buffer;
v72[0] = Length;
v72[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4648,
(unsigned __int8 *)byte_140023309,
&v56,
0i64,
4u,
&v68);
}
VrpGetNextToken(&NewPath, &Position, &PathToken);
if( !(unsigned __int8)RtlEqualUnicodeString(&PathToken, &VrpRegistryString, 1u) )
{
LABEL_10:
NamespaceNodePlaceholderKey = -1073741790;
goto LABEL_55;
}
VrpGetNextToken(&NewPath, &Position, &PathToken);
if( (unsigned __int8)RtlEqualUnicodeString(&PathToken, &VrpAppString, 1u)
|| (unsigned __int8)RtlEqualUnicodeString(&PathToken, &VrpWcString, 1u) )
{
NamespaceNodePlaceholderKey = 0;
}
else
{
if( (v4[6] & 0x10) != 0 )
{
NamespaceNodePlaceholderKey = 0;
v11 = JobContext;
goto LABEL_58;
}
v12 = (_UNICODE_STRING *)&VrpMachineString;
if( !(unsigned __int8)RtlEqualUnicodeString(&PathToken, &VrpMachineString, 1u) )
{
v12 = (_UNICODE_STRING *)&VrpUserString;
if( !(unsigned __int8)RtlEqualUnicodeString(&PathToken, &VrpUserString, 1u) )
goto LABEL_10;
}
InputString.Buffer = &NewPath.Buffer[Position];
InputString.Length = NewPath.Length - 2 * Position;
InputString.MaximumLength = InputString.Length;
VrpStripTrailingCharacters(&InputString, 2 * Position);
v13 = 0;
if( InputString.Length )
{
v14 = InputString.Buffer;
while( *v14 != 92 )
{
++v13;
++v14;
if( 2i64 * v13 >= (unsigned __int64)InputString.Length )
goto LABEL_22;
}
goto LABEL_10;
}
LABEL_22:
NamespaceNodePlaceholderKey = RtlStringFromGUIDEx((_GUID *)JobContext, &GuidString, 0);
if( NamespaceNodePlaceholderKey >= 0 )
{
++GuidString.Buffer;
GuidString.Length -= 4;
GuidString.MaximumLength -= 4;
Destination.MaximumLength = InputString.Length + v12->Length + GuidString.Length + 40;
Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(1ui64, Destination.MaximumLength, 1734693462i64);
if( !Destination.Buffer )
{
NamespaceNodePlaceholderKey = -1073741670;
goto LABEL_55;
}
RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&VrpRootHivePath);
RtlAppendUnicodeToString(&Destination, (WCHAR *)&stru_1407CDE30.TrapFrame);
RtlAppendUnicodeStringToString(&Destination, &GuidString);
RtlAppendUnicodeToString(&Destination, (WCHAR *)&stru_1407CDE30.OutputLength);
RtlAppendUnicodeStringToString(&Destination, v12);
RtlAppendUnicodeToString(&Destination, (WCHAR *)&stru_1407CDE30.OutputLength);
RtlAppendUnicodeStringToString(&Destination, &InputString);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)JobContext + 2, 0i64);
v32 = 1;
v37 = 1;
NamespaceNodePlaceholderKey = VrpCreateNamespaceNode(
(UINT64 *)JobContext,
&NewPath,
0i64,
(const VOID **)&Destination,
0x80000000,
-1,
(__int64)&v43);
if( NamespaceNodePlaceholderKey >= 0 )
{
v16 = v43;
NamespaceNodePlaceholderKey = VrpAddNamespaceNodeToList(JobContext, (_UNICODE_STRING *)v43);
if( NamespaceNodePlaceholderKey >= 0 )
{
NamespaceNodePlaceholderKey = VrpCreateNamespaceNodePlaceholderKey(v16);
if( NamespaceNodePlaceholderKey >= 0 )
{
SourceFile.Length = 48;
SourceFile.RootDirectory = 0i64;
SourceFile.Attributes = 576;
SourceFile.ObjectName = (_UNICODE_STRING *)*((_QWORD *)v4 + 2);
*(_OWORD *)&SourceFile.SecurityDescriptor = 0i64;
TargetKey.Length = 48;
TargetKey.RootDirectory = 0i64;
TargetKey.Attributes = 576;
TargetKey.ObjectName = &Destination;
*(_OWORD *)&TargetKey.SecurityDescriptor = 0i64;
v17 = (VOID *)*((_QWORD *)v4 + 4);
if( !v17
|| (LOBYTE(AccessMode) = 0,
NamespaceNodePlaceholderKey = ObOpenObjectByPointer(
v17,
0x200ui64,
0i64,
0,
(POBJECT_TYPE)CmKeyObjectType,
AccessMode,
&TrustClassKey),
NamespaceNodePlaceholderKey >= 0) )
{
v18 = (VOID *)*((_QWORD *)v4 + 5);
if( !v18
|| (LOBYTE(AccessMode) = 0,
NamespaceNodePlaceholderKey = ObOpenObjectByPointer(
v18,
0x200ui64,
0i64,
2,
(POBJECT_TYPE)ExEventObjectType,
AccessMode,
&Event),
NamespaceNodePlaceholderKey >= 0) )
{
KeyName = v50->KeyName;
if( !KeyName
|| (LOBYTE(AccessMode) = 0,
NamespaceNodePlaceholderKey = ObOpenObjectByPointer(
KeyName,
0x200ui64,
0i64,
0,
(POBJECT_TYPE)CmKeyObjectType,
AccessMode,
(VOID **)Handle),
NamespaceNodePlaceholderKey >= 0) )
{
if( *((_QWORD *)v4 + 10) != 2i64
|| (v20 = (VOID *)*((_QWORD *)v4 + 11)) == 0i64
|| (LOBYTE(AccessMode) = 0,
NamespaceNodePlaceholderKey = ObOpenObjectByPointer(
v20,
0x200ui64,
0i64,
0,
(POBJECT_TYPE)SeTokenObjectType,
AccessMode,
&v47),
NamespaceNodePlaceholderKey >= 0) )
{
LODWORD(AccessMode) = v4[12];
NamespaceNodePlaceholderKey = CmLoadDifferencingKey(
&TargetKey,
&SourceFile,
v4[6],
TrustClassKey,
Event,
AccessMode,
(PVOID *)((unsigned __int64)v48 & -(__int64)(*((_QWORD *)v4 + 7) != 0i64)),
0i64,
Handle[0]);
if( NamespaceNodePlaceholderKey >= 0 )
{
if( *((_QWORD *)v4 + 7) )
{
if( *(_QWORD *)v48 )
{
v21 = v4[12];
Object = 0i64;
v22 = ObReferenceObjectByHandle(
*(VOID **)v48,
v21,
(_OBJECT_TYPE *)CmKeyObjectType,
0,
&Object,
0i64);
v23 = Object;
DmaAdapter = (PADAPTER_OBJECT)Object;
if( v22 >= 0 )
{
LODWORD(v24) = VrpAllocateKeyContext(JobContext);
v6 = v24;
v42 = v24;
if( v24 )
{
if( VrpBuildKeyPath(0i64, &NewPath, v24 + 1) >= 0 )
{
*(_DWORD *)(&v6[2].MaximumLength + 1) = 0x20000000;
if( CmSetCallbackObjectContext(v23, &VrpCallbackCookie, v6, 0i64) >= 0 )
{
v6 = 0i64;
v42 = 0i64;
LOBYTE(AccessModea) = KeGetCurrentThread()->PreviousMode;
ObOpenObjectByPointer(
Object,
(_BYTE)AccessModea != 0 ? 64 : 576,
0i64,
v4[12],
(POBJECT_TYPE)CmKeyObjectType,
AccessModea,
&v51);
}
}
}
}
}
**((_QWORD **)v4 + 7) = v51;
}
NamespaceNodePlaceholderKey = -1073740541;
if( *(&stru_140C00F40 + 1162) > 5u )
{
v25 = &NewPath;
if( !NewPath.Buffer )
v25 = (_UNICODE_STRING *)&EmptyUnicodeString;
v58 = v61;
v59 = 2i64;
v60 = v25->Buffer;
v61[0] = v25->Length;
v61[1] = 0;
p_Destination = &Destination;
if( !Destination.Buffer )
p_Destination = (_UNICODE_STRING *)&EmptyUnicodeString;
v62 = v65;
v63 = 2i64;
v64 = p_Destination->Buffer;
v65[0] = p_Destination->Length;
v65[1] = 0;
v38 = -1073740541;
v66 = &v38;
v67 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4648,
(unsigned __int8 *)byte_1400235A8,
&v56,
0i64,
7u,
&v57);
}
}
}
}
}
}
}
}
}
}
}
LABEL_53:
if( ((NamespaceNodePlaceholderKey + 0x80000000) & 0x80000000) != 0 || NamespaceNodePlaceholderKey == -1073740541 )
{
v11 = JobContext;
goto LABEL_58;
}
LABEL_55:
v11 = JobContext;
if( v43 )
VrpDestroyNamespaceNode((UINT64 *)JobContext, v43);
LABEL_58:
if( v32 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v11 + 2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v11 + 2);
KeAbPostRelease(v11 + 4);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
if( ((NamespaceNodePlaceholderKey + 0x80000000) & 0x80000000) == 0
&& NamespaceNodePlaceholderKey != -1073740541
&& *(&stru_140C00F40 + 1162) > 2u )
{
v39 = NamespaceNodePlaceholderKey;
v74 = &v39;
v75 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4648,
(unsigned __int8 *)&dword_140023434,
&v56,
0i64,
3u,
&v73);
}
if( v6 )
VrpFreeKeyContext(v6);
if( TrustClassKey )
ObCloseHandle(TrustClassKey, 0);
if( Event )
ObCloseHandle(Event, 0);
if( *(_QWORD *)Handle )
ObCloseHandle(*(VOID **)Handle, 0);
if( v47 )
ObCloseHandle(v47, 0);
if( *(_QWORD *)v48 )
ObCloseHandle(*(VOID **)v48, 0);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( v30 == 1 )
ExFreePoolWithTag(NewPath.Buffer, 0x67655256u);
if( Destination.Buffer )
ExFreePoolWithTag(Destination.Buffer, 0x67655256u);
return NamespaceNodePlaceholderKey;
}Referenced by:
VrpRegistryCallback