CmpCallbackFillObjectContext
VOID __stdcall CmpCallbackFillObjectContext(REG_NOTIFY_CLASS Type, PVOID Argument, LARGE_INTEGER *Cookie){
_DWORD *v5;
__int64 v6;
_QWORD *v7;
_DWORD *v8;
__int64 v9;
_QWORD *v10;
_DWORD *v11;
__int64 v12;
_QWORD *v13;
_DWORD *v14;
__int64 v15;
_QWORD *v16;
_DWORD *v17;
__int64 v18;
_QWORD *v19;
_DWORD *v20;
_QWORD *v21;
_ETHREAD *v22;
_QWORD *v23;
LONGLONG v24;
__int64 v25;
_DWORD *v26;
_QWORD *v27;
_ETHREAD *v28;
LONGLONG v29;
__int64 v30;
__int64 v31;
__int64 v32;
__int64 v33;
__int64 v34;
_ETHREAD *v35;
_QWORD *v36;
LONGLONG v37;
_ETHREAD *CurrentThread;
_QWORD *v39;
LONGLONG QuadPart;
_ETHREAD *v41;
LONGLONG v42;
__int64 v43;
_ETHREAD *v44;
_QWORD *v45;
LONGLONG v46;
_ETHREAD *v47;
_QWORD *v48;
LONGLONG v49;
switch( Type )
{
case RegNtPostOpenKeyEx:
LABEL_15:
v9 = 0i64;
LABEL_14:
*((_QWORD *)Argument + 5) = v9;
return;
case RegNtPreOpenKeyEx:
LABEL_16:
v11 = (_DWORD *)*((_QWORD *)Argument + 1);
v12 = 0i64;
if( v11 )
{
if( *v11 == 1803104306 )
{
v13 = v11 + 18;
if( (_QWORD *)*v13 != v13 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v39 = (_QWORD *)*v13;
if( (_QWORD *)*v13 != v13 )
{
QuadPart = Cookie->QuadPart;
while( v39[4] != QuadPart )
{
if( v39[4] >= QuadPart )
{
v39 = (_QWORD *)*v39;
if( v39 != v13 )
continue;
}
goto LABEL_61;
}
v12 = v39[7];
}
LABEL_61:
ExReleasePushLockEx((UINT64)&CmpContextListLock, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
}
}
*((_QWORD *)Argument + 11) = v12;
break;
case RegNtPostQueryValueKey:
LABEL_11:
v8 = *(_DWORD **)Argument;
v9 = 0i64;
if( *(_QWORD *)Argument )
{
if( *v8 == 1803104306 )
{
v10 = v8 + 18;
if( (_QWORD *)*v10 != v10 )
{
v35 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v35 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v36 = (_QWORD *)*v10;
if( (_QWORD *)*v10 != v10 )
{
v37 = Cookie->QuadPart;
while( v36[4] != v37 )
{
if( v36[4] >= v37 )
{
v36 = (_QWORD *)*v36;
if( v36 != v10 )
continue;
}
goto LABEL_56;
}
v9 = v36[7];
}
LABEL_56:
ExReleasePushLockEx((UINT64)&CmpContextListLock, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
}
}
goto LABEL_14;
case RegNtQueryValueKey:
v14 = *(_DWORD **)Argument;
v15 = 0i64;
if( *(_QWORD *)Argument )
{
if( *v14 == 1803104306 )
{
v16 = v14 + 18;
if( (_QWORD *)*v16 != v16 )
{
v44 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v44 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v45 = (_QWORD *)*v16;
if( (_QWORD *)*v16 != v16 )
{
v46 = Cookie->QuadPart;
while( v45[4] != v46 )
{
if( v45[4] >= v46 )
{
v45 = (_QWORD *)*v45;
if( v45 != v16 )
continue;
}
goto LABEL_76;
}
v15 = v45[7];
}
LABEL_76:
ExReleasePushLockEx((UINT64)&CmpContextListLock, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
}
}
*((_QWORD *)Argument + 7) = v15;
break;
case RegNtPostQueryKey:
goto LABEL_11;
default:
switch( Type )
{
case RegNtDeleteKey:
case RegNtPreFlushKey:
LODWORD(v32) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 2) = v32;
return;
case RegNtSetValueKey:
LODWORD(v30) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 6) = v30;
return;
case RegNtDeleteValueKey:
case RegNtRenameKey:
case RegNtPreUnLoadKey:
LODWORD(v31) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 3) = v31;
return;
case RegNtSetInformationKey:
case RegNtPreQueryKeySecurity:
case RegNtPreQueryKeyName:
LODWORD(v25) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 5) = v25;
return;
case RegNtEnumerateKey:
v26 = *(_DWORD **)Argument;
v6 = 0i64;
if( !*(_QWORD *)Argument )
goto LABEL_10;
if( *v26 != 1803104306 )
goto LABEL_10;
v27 = v26 + 18;
if( (_QWORD *)*v27 == v27 )
goto LABEL_10;
v28 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v28 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v23 = (_QWORD *)*v27;
if( (_QWORD *)*v27 == v27 )
goto LABEL_69;
v29 = Cookie->QuadPart;
while( v23[4] != v29 )
{
if( v23[4] >= v29 )
{
v23 = (_QWORD *)*v23;
if( v23 != v27 )
continue;
}
goto LABEL_69;
}
goto LABEL_68;
case RegNtEnumerateValueKey:
v20 = *(_DWORD **)Argument;
v6 = 0i64;
if( !*(_QWORD *)Argument )
goto LABEL_10;
if( *v20 != 1803104306 )
goto LABEL_10;
v21 = v20 + 18;
if( (_QWORD *)*v21 == v21 )
goto LABEL_10;
v22 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v22 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v23 = (_QWORD *)*v21;
if( (_QWORD *)*v21 == v21 )
goto LABEL_69;
v24 = Cookie->QuadPart;
while( v23[4] != v24 )
{
if( v23[4] >= v24 )
{
v23 = (_QWORD *)*v23;
if( v23 != v21 )
continue;
}
goto LABEL_69;
}
goto LABEL_68;
case RegNtQueryKey:
v5 = *(_DWORD **)Argument;
v6 = 0i64;
if( !*(_QWORD *)Argument )
goto LABEL_10;
if( *v5 != 1803104306 )
goto LABEL_10;
v7 = v5 + 18;
if( (_QWORD *)*v7 == v7 )
goto LABEL_10;
v41 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v41 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v23 = (_QWORD *)*v7;
if( (_QWORD *)*v7 == v7 )
goto LABEL_69;
v42 = Cookie->QuadPart;
while( v23[4] != v42 )
{
if( v23[4] >= v42 )
{
v23 = (_QWORD *)*v23;
if( v23 != v7 )
continue;
}
goto LABEL_69;
}
LABEL_68:
v6 = v23[7];
LABEL_69:
ExReleasePushLockEx((UINT64)&CmpContextListLock, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LABEL_10:
*((_QWORD *)Argument + 6) = v6;
return;
case RegNtQueryMultipleValueKey:
LODWORD(v43) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 7) = v43;
return;
case RegNtKeyHandleClose:
v17 = *(_DWORD **)Argument;
v18 = 0i64;
if( !*(_QWORD *)Argument )
goto LABEL_27;
if( *v17 != 1803104306 )
goto LABEL_27;
v19 = v17 + 18;
if( (_QWORD *)*v19 == v19 )
goto LABEL_27;
v47 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v47 + 242);
ExAcquirePushLockSharedEx((UINT64)&CmpContextListLock, 0i64);
v48 = (_QWORD *)*v19;
if( (_QWORD *)*v19 == v19 )
goto LABEL_81;
v49 = Cookie->QuadPart;
break;
case RegNtPostDeleteKey:
case RegNtPostSetValueKey:
case RegNtPostDeleteValueKey:
case RegNtPostSetInformationKey:
case RegNtPostRenameKey:
case RegNtPostEnumerateKey:
case RegNtPostEnumerateValueKey:
case RegNtPostQueryKey:
case RegNtPostQueryValueKey:
case RegNtPostQueryMultipleValueKey:
case RegNtPostFlushKey:
case RegNtPostLoadKey:
case RegNtPostUnLoadKey:
case RegNtPostQueryKeySecurity:
case RegNtPostSetKeySecurity:
case RegNtPostRestoreKey:
case RegNtPostSaveKey:
case RegNtPostReplaceKey:
case RegNtPostQueryKeyName:
goto LABEL_11;
case RegNtPostKeyHandleClose:
case RegNtPostCreateKeyEx:
goto LABEL_15;
case RegNtPreCreateKeyEx:
goto LABEL_16;
case RegNtPreLoadKey:
LODWORD(v34) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 9) = v34;
return;
case RegNtPreSetKeySecurity:
case RegNtPreRestoreKey:
case RegNtPreSaveKey:
case RegNtPreReplaceKey:
LODWORD(v33) = CmpGetCallbackObjectContext(*(PVOID *)Argument, Cookie);
*((_QWORD *)Argument + 4) = v33;
return;
default:
return;
}
while( v48[4] != v49 )
{
if( v48[4] >= v49 )
{
v48 = (_QWORD *)*v48;
if( v48 != v19 )
continue;
}
goto LABEL_81;
}
v18 = v48[7];
LABEL_81:
ExReleasePushLockEx((UINT64)&CmpContextListLock, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LABEL_27:
*((_QWORD *)Argument + 2) = v18;
return;
}
}Referenced by:
CmpCallCallBacksEx