CmpReorganizeHive
__int64 __fastcall CmpReorganizeHive(ULONG_PTR a1, unsigned __int16 *a2, int a3){
__int64 v3;
__int64 v7;
int v8;
int v9;
int v10;
__int64 v12;
unsigned int v13;
unsigned __int64 v14;
__int64 v15;
unsigned __int16 v16;
int EmptyHiveClone;
_HHIVE *v18;
unsigned int v19;
_CHILD_LIST *v20;
INT64 v21;
int v22;
int v23;
int v24;
int v25;
int v26;
unsigned int Length;
unsigned int v28;
__int64 v29;
union _LARGE_INTEGER v30;
CHAR v31;
INT64 v32;
UINT64 v33;
unsigned __int64 v34;
__int16 v35;
__int16 v36;
__int16 v37;
int v38;
int v39;
int v40;
unsigned int v41;
unsigned int v42;
PVOID P;
__int64 v44;
__int64 v45;
__int64 v46;
__int64 v47;
__int64 v48;
__int128 v49;
struct _EVENT_DATA_DESCRIPTOR v50;
int *v51;
__int64 v52;
__int16 *v53;
__int64 v54;
__int16 *v55;
__int64 v56;
__int16 *v57;
__int64 v58;
__int64 v59;
__int64 v60;
__int64 v61;
int v62;
int v63;
__int64 v64;
__int64 v65;
__int64 v66;
int v67;
int v68;
__int64 v69;
__int64 v70;
__int64 v71;
int v72;
int v73;
__int64 *v74;
__int64 v75;
struct _EVENT_DATA_DESCRIPTOR v76;
__int64 *v77;
__int64 v78;
int *v79;
__int64 v80;
int *v81;
__int64 v82;
__int64 *v83;
__int64 v84;
struct _EVENT_DATA_DESCRIPTOR v85;
int *v86;
__int64 v87;
int *v88;
__int64 v89;
__int64 *v90;
__int64 v91;
struct _EVENT_DATA_DESCRIPTOR v92;
unsigned __int64 *v93;
__int64 v94;
__int64 *v95;
__int64 v96;
v3 = *(_QWORD *)(a1 + 64);
P = 0i64;
v7 = 0i64;
v8 = *(_DWORD *)(v3 + 144);
v49 = 0i64;
if( (v8 & 1) != 0 )
return 0;
v9 = *(_DWORD *)(a1 + 160);
if( (v9 & 0x10) == 0 && !*(_QWORD *)(a1 + 1536) )
return 0;
if( (v9 & 0x8001) != 0 || !*(_DWORD *)(a1 + 164) )
return 0;
if( !CmpAcquireShutdownRundown() )
{
v10 = -1073741431;
LABEL_25:
if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
{
LODWORD(v34) = v10;
v93 = &v34;
v94 = 4i64;
v95 = &v48;
v48 = 0x1000000i64;
v96 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)&byte_140022727,
0i64,
0i64,
4u,
&v92);
}
return(unsigned int)v10;
}
if( (a3 & 0x400000) != 0
&& (unsigned __int8)ExIsSoftBoot()
&& (unsigned __int64)(*(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64) - 1i64) > 1 )
{
goto LABEL_12;
}
v12 = *(_QWORD *)(a1 + 64);
v13 = KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFC;
v34 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64;
v14 = *(_QWORD *)(v12 + 168);
if( v14 <= (*(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64)
&& (*(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64) - v14 < 864000000000i64
* (unsigned __int64)(unsigned int)CmpReorganizeDelayDays )
{
goto LABEL_12;
}
if( !a2 )
{
v15 = v12 + 48;
v16 = 0;
*((_QWORD *)&v49 + 1) = v15;
do
{
if( !*(_WORD *)(v15 + 2i64 * v16) )
break;
++v16;
}
while( v16 < 0x1Fu );
a2 = (unsigned __int16 *)&v49;
LOWORD(v49) = 2 * v16;
}
if( v14 == 2 || v14 != 1 && (*(_DWORD *)(a1 + 4152) & 0x400) == 0 )
{
LODWORD(v34) = v13 | 2;
CmpClearKeyAccessBits(a1, a2);
CmpLockRegistry();
HvLockHiveFlusherShared(a1);
HvLockHiveWriter(a1);
HvMarkBaseBlockDirty((_HHIVE *)a1);
*(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64) = v34;
HvUnlockHiveWriter(a1);
HvUnlockHiveFlusherShared(a1);
CmpUnlockRegistry();
LABEL_12:
v10 = 0;
goto LABEL_13;
}
if( *(_DWORD *)(*(_QWORD *)(a1 + 64) + 36i64) == -1 )
goto LABEL_12;
LODWORD(v34) = v13 | 1;
EmptyHiveClone = CmpCreateEmptyHiveClone((INT64 *)&P, a1);
v18 = (_HHIVE *)P;
v10 = EmptyHiveClone;
if( EmptyHiveClone >= 0 )
{
LODWORD(v33) = 0;
v19 = CmpCopyKeyPartial(a1, *(unsigned int *)(*(_QWORD *)(a1 + 64) + 36i64), (UINT64)P, 0xFFFFFFFFui64, 6, v31, v33);
if( v19 != -1
&& (v18->BaseBlock->RootCell = v19,
HvMarkBaseBlockDirty(v18),
LODWORD(v32) = 0,
CmpCopySyncTree(a1, *(unsigned int *)(*(_QWORD *)(a1 + 64) + 36i64), (UINT64)v18, v19, 66, v32))
&& (CmpAllocateTransientPoolWithTag((_HHIVE *)1, 0x1B0ui64, 0x33394D43ui64, v20), (v7 = v21) != 0) )
{
memset(v21, 0i64);
v10 = CmCheckRegistry((ULONG_PTR)v18, 2031616i64, v7);
if( v10 >= 0 )
{
if( (*(_DWORD *)(*(_QWORD *)(a1 + 64) + 4088i64) & 4) != 0
|| *(_DWORD *)(a1 + 4804) == v18[3].LastLogSwapTime.HighPart )
{
v18->HiveLoadFailure = 0i64;
Length = v18->Storage[0].Length;
v28 = *(_DWORD *)(a1 + 272);
CmpSwapHiveStorage(a1, (INT64)v18);
if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
{
v29 = *(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64);
v77 = &v46;
v79 = (int *)&v41;
v81 = (int *)&v42;
v83 = &v47;
v46 = v29;
v78 = 8i64;
v41 = v28;
v80 = 4i64;
v42 = Length;
v82 = 4i64;
v47 = 0x1000000i64;
v84 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)byte_1400227D1,
0i64,
0i64,
6u,
&v76);
}
CmpLockRegistry();
HvLockHiveFlusherShared(a1);
HvLockHiveWriter(a1);
HvMarkBaseBlockDirty((_HHIVE *)a1);
v30.QuadPart = v34;
*(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64) = v34;
HvUnlockHiveWriter(a1);
HvUnlockHiveFlusherShared(a1);
CmpUnlockRegistry();
CmpLogReorganizeEvent((UNICODE_STRING *)a2, v28, Length);
if( Length < v28 )
{
if( CmpFirstReorganize )
{
*(_QWORD *)CmpReorganizeTotalBytesSaved = 0i64;
CmpReorganizeLastRun = v30;
CmpFirstReorganize = 0;
}
*(_QWORD *)CmpReorganizeTotalBytesSaved += v28 - Length;
CmpUpdateReorganizeRegistryValues();
}
v10 = 0;
}
else
{
if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
{
v39 = v25;
v86 = &v39;
v87 = 4i64;
v88 = &v40;
v40 = v26;
v90 = &v45;
v89 = 4i64;
v45 = 0x1000000i64;
v91 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)byte_140022769,
0i64,
0i64,
5u,
&v85);
}
CmpLockRegistry();
HvLockHiveFlusherShared(a1);
HvLockHiveWriter(a1);
HvMarkBaseBlockDirty((_HHIVE *)a1);
*(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64) = v34;
HvUnlockHiveWriter(a1);
HvUnlockHiveFlusherShared(a1);
CmpUnlockRegistry();
v10 = -1073741492;
}
}
else
{
if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
{
v38 = v10;
v51 = &v38;
v53 = &v35;
v22 = *(unsigned __int16 *)(v7 + 8);
v23 = *(unsigned __int16 *)(v7 + 10);
v59 = v7 + 8;
v55 = &v36;
v61 = v7 + 12;
v24 = *(unsigned __int8 *)(v7 + 394);
v62 = 12 * v22;
v66 = v7 + 108;
v67 = 12 * v23;
v71 = v7 + 396;
v74 = &v44;
v37 = v24;
v35 = v22;
v36 = v23;
v64 = v7 + 10;
v69 = v7 + 394;
v52 = 4i64;
v54 = 2i64;
v56 = 2i64;
v57 = &v37;
v58 = 2i64;
v60 = 2i64;
v63 = 0;
v65 = 2i64;
v68 = 0;
v70 = 2i64;
v72 = 8 * v24;
v73 = 0;
v44 = 0x1000000i64;
v75 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)&byte_140022827,
0i64,
0i64,
0xDu,
&v50);
}
if( v10 == -1073741492 || v10 == -2147483606 )
{
CmpLockRegistry();
HvLockHiveFlusherShared(a1);
HvLockHiveWriter(a1);
HvMarkBaseBlockDirty((_HHIVE *)a1);
*(_QWORD *)(*(_QWORD *)(a1 + 64) + 168i64) = v34;
HvUnlockHiveWriter(a1);
HvUnlockHiveFlusherShared(a1);
CmpUnlockRegistry();
}
}
}
else
{
v10 = -1073741670;
}
}
if( v18 )
CmpDestroyHive(v18);
LABEL_13:
CmpReleaseShutdownRundown();
if( v7 )
CmSiFreeMemory((PPRIVILEGE_SET)v7);
if( v10 < 0 )
goto LABEL_25;
return(unsigned int)v10;
}Referenced by:
CmpCreateHive