NtSetValueKey
NTSTATUS __stdcall NtSetValueKey(
VOID *KeyHandle,
UNICODE_STRING *ValueName,
UINT64 TitleIndex,
UINT64 Type,
VOID *Data,
UINT64 DataSize){
char v7;
char v8;
WCHAR v9;
unsigned __int8 v10;
char v11;
_ETHREAD *CurrentThread;
INT8 v13;
bool v14;
NTSTATUS v15;
signed __int8 v16;
unsigned __int16 Length;
unsigned int v18;
UINT8 *v19;
unsigned int v20;
unsigned int v21;
unsigned int v22;
unsigned int v23;
INT64 v24;
char *v25;
UINT64 v26;
wchar_t *v27;
char v28;
_ETHREAD *v29;
void *v30;
INT8 v32;
bool v33;
_DMA_OPERATIONS *v34;
OBJECT_HANDLE_INFORMATION *HandleInformation;
unsigned __int8 v36;
bool v37;
char v38;
NTSTATUS v39;
struct _UNICODE_STRING DestinationString;
PADAPTER_OBJECT DmaAdapter;
void *Src;
UINT8 *dst;
int v44;
_DWORD v45[3];
int v46;
__int64 v47;
PVOID Handle;
_DMA_OPERATIONS *DmaOperations;
INT64 a6[2];
char *v51;
__int128 v52;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
INT64 result[2];
int v55;
int v56;
void *v57;
unsigned int v58;
LARGE_INTEGER v59[2];
__int128 v60;
char v61[64];
v45[0] = Type;
v46 = TitleIndex;
Handle = KeyHandle;
Src = Data;
DestinationString = 0i64;
v47 = 0i64;
*(_OWORD *)&v59[0].LowPart = 0i64;
v60 = 0i64;
DmaOperations = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(v59, 0x20000ui64);
v7 = 0;
DmaAdapter = 0i64;
v8 = 0;
v38 = 0;
a6[1] = (INT64)a6;
a6[0] = (INT64)a6;
memset((INT64)result, 0i64);
RtlInitUnicodeString(&DestinationString, 0i64, v9);
dst = 0i64;
v51 = 0i64;
v44 = 0;
*(_QWORD *)&v45[1] = 0i64;
v10 = *((_BYTE *)KeGetCurrentThread() + 562);
v36 = v10;
v11 = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v14 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
v37 = v14;
if( !v14 )
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
if( !v14 )
{
v15 = -1073741431;
v39 = -1073741431;
LABEL_97:
v28 = 0;
goto LABEL_74;
}
v15 = CmObReferenceObjectByHandle(Handle, 2ui64, v13, (PVOID *)v10, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
v39 = v15;
if( v15 != -1073741790 )
{
LABEL_7:
v11 = v8;
if( v15 >= 0 )
{
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
DmaOperations = DmaAdapter->DmaOperations;
v16 = v36;
if( v36 == 1 )
{
v52 = 0i64;
if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
ValueName = (UNICODE_STRING *)0x7FFFFFFF0000i64;
LODWORD(v52) = *(_DWORD *)&ValueName->Length;
*((_QWORD *)&v52 + 1) = ValueName->Buffer;
DestinationString = (struct _UNICODE_STRING)v52;
DestinationString.MaximumLength = v52;
Length = v52;
if( (_WORD)v52 )
{
if( ((__int64)DestinationString.Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( (wchar_t *)((char *)DestinationString.Buffer + (unsigned __int16)v52) > (wchar_t *)0x7FFFFFFF0000i64
|| (char *)DestinationString.Buffer + (unsigned __int16)v52 < (char *)DestinationString.Buffer )
{
MEMORY[0x7FFFFFFF0000] = 0;
Length = DestinationString.Length;
}
}
v18 = DataSize;
v19 = (UINT8 *)Src;
if( (_DWORD)DataSize
&& ((unsigned __int64)Src + (unsigned int)DataSize > 0x7FFFFFFF0000i64
|| (char *)Src + (unsigned int)DataSize < Src) )
{
MEMORY[0x7FFFFFFF0000] = 0;
Length = DestinationString.Length;
}
}
else
{
DestinationString = *ValueName;
dst = 0i64;
v18 = DataSize;
if( !(_DWORD)DataSize )
{
Length = DestinationString.Length;
v19 = (UINT8 *)Src;
goto LABEL_20;
}
Length = DestinationString.Length;
v19 = (UINT8 *)Src;
}
v16 = v36;
LABEL_20:
if( Length > 0x7FFFu || (DestinationString.Length & 1) != 0 || v18 > 0x7FFFF000 )
{
v15 = -1073741811;
v39 = -1073741811;
v11 = v8;
v28 = 0;
goto LABEL_74;
}
v20 = Length;
v21 = (Length + 7) & 0xFFFFFFF8;
v22 = v21 + v18;
if( v21 + v18 < v18 )
{
v15 = -1073741811;
v39 = -1073741811;
v11 = v8;
v14 = v37;
v7 = 0;
v28 = 0;
goto LABEL_74;
}
v23 = v16;
if( CmpDoesBufferRequireCapturing((unsigned int)v16, DestinationString.Buffer)
|| CmpDoesBufferRequireCapturing(v23, v19) )
{
if( v22 )
{
if( v22 <= 0x40 )
goto LABEL_27;
if( v18 <= 0x40 )
{
if( Length <= 0x40u && v18 < Length )
v20 = v18;
}
else
{
v20 = Length > 0x40u ? v21 + v18 : v18;
}
if( v20 )
{
*(_QWORD *)&v45[1] = CmpAllocateTransientPoolWithQuotaTag(v24, v20, 0x6E566D43ui64);
if( !*(_QWORD *)&v45[1] )
{
v15 = -1073741670;
v39 = -1073741670;
v11 = v38;
v14 = v37;
v7 = 0;
v28 = 0;
goto LABEL_74;
}
Length = DestinationString.Length;
if( v20 == v18 )
{
dst = (UINT8 *)v61;
v25 = *(char **)&v45[1];
}
else
{
dst = *(UINT8 **)&v45[1];
if( v20 == DestinationString.Length )
v25 = v61;
else
v25 = (char *)(*(_QWORD *)&v45[1] + v21);
}
}
else
{
LABEL_27:
dst = (UINT8 *)v61;
v25 = &v61[v21];
}
}
else
{
v25 = v51;
}
if( Length )
{
v26 = Length;
v27 = (wchar_t *)dst;
memmove(dst, (UINT8 *)DestinationString.Buffer, v26);
DestinationString.Buffer = v27;
Length = DestinationString.Length;
}
else
{
DestinationString.Buffer = 0i64;
}
if( v18 )
{
memmove((UINT8 *)v25, v19, v18);
Src = v25;
Length = DestinationString.Length;
}
else
{
Src = 0i64;
}
}
if( Length )
{
do
{
if( DestinationString.Buffer[((unsigned __int64)Length >> 1) - 1] )
break;
v33 = Length == 2;
Length -= 2;
DestinationString.Length = Length;
}
while( !v33 );
}
if( (LODWORD(DmaAdapter->DmaOperations->PutDmaAdapter) & 0x80u) != 0 )
{
v15 = -1073741790;
v39 = -1073741790;
v11 = v38;
v7 = 0;
v28 = 0;
goto LABEL_73;
}
v29 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v29 + 242);
if( !CmpCallBackCount || ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
{
v30 = Src;
v7 = 0;
}
else
{
result[0] = (INT64)DmaAdapter;
result[1] = (INT64)&DestinationString;
v55 = v46;
v56 = v45[0];
v30 = Src;
v57 = Src;
v58 = v18;
v15 = CmpCallCallBacksEx(
RegNtSetValueKey,
(SLIST_ENTRY **)result,
0i64,
1,
RegNtPostSetValueKey,
(INT64)DmaAdapter,
(INT64)a6);
if( v15 < 0 )
{
if( v15 == -1073740541 )
v15 = 0;
v39 = v15;
v11 = v38;
v7 = 0;
goto LABEL_72;
}
v7 = 1;
}
if( !v38
|| (HandleInformation = (OBJECT_HANDLE_INFORMATION *)&v44,
v15 = CmKeyBodyReplicateToVirtual((__int64 *)&DmaAdapter, v36, 2u, (__int64 *)&SubjectContext),
v39 = v15,
v11 = v38,
v15 >= 0) )
{
LODWORD(HandleInformation) = v18;
v15 = CmSetValueKey(
(INT64)DmaAdapter,
&DestinationString.Length,
v45[0],
v30,
(UINT64)HandleInformation,
(UINT64)Handle,
(v47 & 4) != 0);
v39 = v15;
v11 = v38;
}
LABEL_72:
v28 = 1;
LABEL_73:
v14 = v37;
goto LABEL_74;
}
goto LABEL_97;
}
SeCaptureSubjectContext(&SubjectContext);
v11 = 1;
if( !CmDoVirtualTest((UINT64 *)&SubjectContext) )
{
v15 = -1073741790;
v39 = -1073741790;
v28 = 0;
goto LABEL_74;
}
v15 = CmObReferenceObjectByHandle(Handle, 0x20019ui64, v32, (PVOID *)v36, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
v39 = v15;
if( v15 < 0 )
goto LABEL_97;
if( CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter) )
{
v8 = 1;
v38 = 1;
goto LABEL_7;
}
v15 = -1073741790;
v39 = -1073741790;
v28 = 0;
LABEL_74:
if( v11 )
SeReleaseSubjectContext(&SubjectContext);
if( v7 )
{
v15 = CmPostCallbackNotificationEx(
RegNtPostSetValueKey,
(SLIST_ENTRY *)DmaAdapter,
(unsigned int)v15,
(INT64)result,
0i64,
(INT64)a6);
v39 = v15;
}
if( v28 )
{
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v15 = v39;
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
v34 = DmaOperations;
LOBYTE(v34) = 14;
(*(void(__fastcall **)(_DMA_OPERATIONS *, LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, struct _UNICODE_STRING *))((char *)&NlsMbCodePageTag + 7))(
v34,
v59,
(unsigned int)v15,
0i64,
DmaOperations,
&DestinationString);
}
if( *(_QWORD *)&v45[1] )
CmSiFreeMemory(*(PPRIVILEGE_SET *)&v45[1]);
if( v14 )
{
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v39;
}
return v15;
}Referenced by:
CmpAddDockingInfo
ExpUpdateProductSuiteTypeInRegistry
ExpWatchLicenseInfoWork
ExpWatchProductTypeWork
InitSafeBoot
IopStoreSystemPartitionInformation