CmpFlushHive
__int64 __fastcall CmpFlushHive(ULONG_PTR BugCheckParameter2, int a2, EVENT_DESCRIPTOR *a3){
int valid;
UINT64 v6;
INT64 v7;
EVENT_DESCRIPTOR *v8;
int v9;
unsigned int v10;
unsigned int v11;
int v12;
int v13;
_HIVE_WRITE_WAIT_QUEUE *v14;
UINT64 v15;
unsigned int Ptr;
int v17;
unsigned int v18;
unsigned int Ptr_high;
struct _REAL_NOTIFY_SYNC *v20;
void *v21;
unsigned int v22;
INT64 v23;
UINT64 v24;
INT64 v25;
INT64 v26;
struct _REAL_NOTIFY_SYNC *v27;
void *v28;
struct _KEVENT *v29;
int v30;
char v31;
bool v32;
UINT64 v34;
INT64 v35;
INT64 v36;
int v37;
INT64 v38;
INT64 v39;
INT64 v40;
unsigned __int64 v41;
unsigned int v42;
__int64 v43;
unsigned int v44;
unsigned __int64 v45;
__int64 v46;
__int64 v47;
unsigned int v48;
__int64 v49;
int v50;
int v51;
unsigned int v52;
INT64 v53;
UINT64 Flags;
int v55;
UINT64 LogEntrySize;
PRKEVENT EventDescriptor;
EVENT_DESCRIPTOR EventDescriptor_8;
struct _EVENT_DATA_DESCRIPTOR v59;
__int64 v60;
int v61;
EVENT_DESCRIPTOR *p_EventDescriptor_8;
__int64 v63;
EVENT_DATA_DESCRIPTOR UserData[2];
int *v65;
__int64 v66;
PRKEVENT *p_EventDescriptor;
int v68;
int v69;
int *v70;
__int64 v71;
__int64 v72;
int v73[2];
UINT64 *p_Flags;
__int64 v75;
v60 = 0i64;
v61 = 0;
LODWORD(LogEntrySize) = 0;
v59 = 0i64;
valid = 0;
if( (unsigned int)dword_140C02130 > 4 )
{
LODWORD(Flags) = a2;
v65 = &v68;
p_EventDescriptor = *(PRKEVENT **)(BugCheckParameter2 + 1856);
v68 = *(unsigned __int16 *)(BugCheckParameter2 + 1848);
v70 = v73;
v72 = *(_QWORD *)(BugCheckParameter2 + 1840);
v73[0] = *(unsigned __int16 *)(BugCheckParameter2 + 1832);
p_Flags = &Flags;
v66 = 2i64;
v69 = 0;
v71 = 2i64;
v73[1] = 0;
v75 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)&byte_1400223EF,
0i64,
0i64,
7u,
UserData);
}
v6 = EtwpRegTraceHandle;
v55 = a2;
EventDescriptor_8 = (EVENT_DESCRIPTOR)REGISTRY_PERF_EVENT_HIVE_FLUSH_START;
if( EtwEventEnabled(EtwpRegTraceHandle, &EventDescriptor_8, a3) )
{
v41 = *(_QWORD *)(BugCheckParameter2 + 1840);
v42 = 0;
LOWORD(Flags) = 0;
if( v41 )
{
UserData[0].Ptr = v41;
v42 = 1;
UserData[0].Size = *(unsigned __int16 *)(BugCheckParameter2 + 1832);
UserData[0].Reserved = 0;
}
v43 = v42;
v44 = v42 + 1;
UserData[v43].Ptr = (unsigned __int64)&Flags;
*(_QWORD *)&UserData[v43].Size = 2i64;
v45 = *(_QWORD *)(BugCheckParameter2 + 1856);
if( v45 )
{
v46 = v44++;
UserData[v46].Ptr = v45;
UserData[v46].Size = *(unsigned __int16 *)(BugCheckParameter2 + 1848);
UserData[v46].Reserved = 0;
}
v47 = v44;
v48 = v44 + 1;
UserData[v47].Ptr = (unsigned __int64)&Flags;
*(_QWORD *)&UserData[v47].Size = 2i64;
v49 = v48;
UserData[v49].Ptr = (unsigned __int64)&v55;
*(_QWORD *)&UserData[v49].Size = 4i64;
EtwWrite(v6, &EventDescriptor_8, 0i64, v48 + 1, UserData);
}
v9 = *(_DWORD *)(BugCheckParameter2 + 160);
if( (v9 & 0x8001) != 0 )
goto LABEL_71;
if( !*(_QWORD *)(BugCheckParameter2 + 1536) )
{
valid = -1073741811;
goto LABEL_71;
}
v10 = 0;
v11 = a2 | 0xC;
if( (v9 & 2) == 0 )
v11 = a2;
LODWORD(Flags) = (v11 >> 4) & 1;
v12 = v11 & 1;
for( *(_DWORD *)&EventDescriptor_8.Id = v12; ; v12 = *(_DWORD *)&EventDescriptor_8.Id )
{
if( v12 )
CmpLockRegistry();
else
CmpLockRegistryFreezeAware(0);
HvLockHiveFlusherExclusive(BugCheckParameter2);
if( (v11 & 2) != 0
&& (PoIsInitializedStopWatch((_QWORD *)(BugCheckParameter2 + 4248))
|| PoIsInitializedStopWatch((_QWORD *)(BugCheckParameter2 + 4232)) && (v11 & 4) == 0) )
{
LABEL_88:
HvUnlockHiveFlusherExclusive(BugCheckParameter2);
CmpUnlockRegistry();
valid = 0;
goto LABEL_71;
}
if( (v11 & 4) != 0 && PoIsInitializedStopWatch((_QWORD *)(BugCheckParameter2 + 4248)) )
goto LABEL_118;
if( !PoIsInitializedStopWatch((_QWORD *)(BugCheckParameter2 + 4232)) )
break;
if( v13 )
{
v50 = 0;
}
else if( *(_DWORD *)(BugCheckParameter2 + 104) || (v50 = 2, *(_BYTE *)(BugCheckParameter2 + 191)) )
{
v50 = 1;
}
valid = CmpWaitOnHiveWriteQueue((_CMHIVE *)BugCheckParameter2, v14, v15);
if( valid >= 0 )
v10 += v50;
LABEL_119:
if( v10 >= 2 )
goto LABEL_71;
}
CmpGenerateFlushControlData(BugCheckParameter2, v11, (INT64 *)&v59);
Ptr = v59.Ptr;
if( (unsigned int)dword_140C02130 > 4 )
{
v69 = 0;
LODWORD(EventDescriptor) = v59.Size;
v65 = &v55;
p_EventDescriptor = &EventDescriptor;
v66 = 4i64;
v68 = 4;
v55 = v59.Ptr;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)word_140022352,
0i64,
0i64,
4u,
UserData);
}
if( (Ptr & 0x358) == 0 )
goto LABEL_88;
if( (Ptr & 2) == 0 )
goto LABEL_20;
if( PoIsInitializedStopWatch((_QWORD *)(BugCheckParameter2 + 4248)) )
{
LABEL_118:
CmpWaitOnHiveWriteQueue((_CMHIVE *)BugCheckParameter2, (_HIVE_WRITE_WAIT_QUEUE *)(BugCheckParameter2 + 4248), v34);
goto LABEL_119;
}
CmpAcquireReconcilerQueue(BugCheckParameter2);
LABEL_20:
if( (Ptr & 1) != 0 )
CmpAcquireFlusherQueue(BugCheckParameter2);
if( (Ptr & 8) == 0 )
{
LABEL_25:
if( (Ptr & 0x158) != 0 )
v17 = HvStoreModifiedData(BugCheckParameter2, (Ptr & 0x110) != 0, (Ptr & 0x40) != 0);
else
v17 = 0;
if( v17 )
{
v51 = v17 - 1;
if( !v51 )
{
valid = 0;
LOBYTE(Ptr_high) = BYTE4(v59.Ptr) | 2;
goto LABEL_61;
}
valid = -1073741823;
if( v51 == 1 )
goto LABEL_122;
}
if( (Ptr & 0x80u) != 0 )
{
v52 = *(_DWORD *)(BugCheckParameter2 + 272);
v18 = *(_DWORD *)(BugCheckParameter2 + 4268);
if( v52 > v18 )
{
Ptr_high = v52 + 4096;
*(_DWORD *)(BugCheckParameter2 + 4268) = 0;
LABEL_30:
HvUnlockHiveFlusherExclusive(BugCheckParameter2);
CmpUnlockRegistry();
if( (Ptr & 0x80u) != 0 )
{
CmpLogFlushPhaseStart(v20, (PLIST_ENTRY)1, v21);
v22 = Flags;
valid = HvExtendHivePrimaryFileValidDataLength(BugCheckParameter2, Ptr_high, (unsigned int)Flags);
CmpLogFlushPhaseEnd(v53, 1, (unsigned int)valid);
LOBYTE(Ptr_high) = BYTE4(v59.Ptr);
if( valid < 0 )
goto LABEL_46;
Ptr_high = HIDWORD(v59.Ptr) | 0x21;
HIDWORD(v59.Ptr) |= 0x21u;
}
else
{
Ptr_high = HIDWORD(v59.Ptr);
v22 = Flags;
}
if( (Ptr & 8) != 0 )
{
CmpLogFlushPhaseStart(v20, (PLIST_ENTRY)2, v21);
valid = HvWriteLogFile((_HHIVE *)BugCheckParameter2, v23, v24, &LogEntrySize);
CmpLogFlushPhaseEnd(v25, 2, (unsigned int)valid);
if( valid < 0 )
goto LABEL_46;
HvTruncateCurrentLogFileIfRequired(BugCheckParameter2);
Ptr_high |= 2u;
HIDWORD(v59.Ptr) = Ptr_high;
}
if( (Ptr & 0x10) != 0 )
{
CmpLogFlushPhaseStart(v20, (PLIST_ENTRY)3, v21);
valid = HvValidateOrInvalidatePrimaryFileHeader(BugCheckParameter2, 0, 1, v22);
CmpLogFlushPhaseEnd(v38, 3, (unsigned int)valid);
if( valid < 0 )
{
Ptr |= 0x400u;
goto LABEL_46;
}
Ptr_high |= 0x20u;
HIDWORD(v59.Ptr) = Ptr_high;
}
CmpLogFlushPhaseStart(v20, (PLIST_ENTRY)4, v21);
if( (Ptr & 0x448) == 72 )
{
RtlMergeBitMaps((RTL_BITMAP *)(BugCheckParameter2 + 1728), (RTL_BITMAP *)(BugCheckParameter2 + 1680));
HvFreeDirtyData(BugCheckParameter2);
Ptr_high |= 4u;
HIDWORD(v59.Ptr) = Ptr_high;
}
CmpLogFlushPhaseEnd(v26, 4, (unsigned int)valid);
if( (Ptr & 0x20) != 0 )
{
HvSwapLogFiles(BugCheckParameter2);
Ptr_high |= 8u;
HIDWORD(v59.Ptr) = Ptr_high;
}
if( (Ptr & 0x45) == 65 )
{
CmpLockRegistry();
HvLockHiveFlusherExclusive(BugCheckParameter2);
v29 = *(struct _KEVENT **)(BugCheckParameter2 + 4240);
*(_QWORD *)(BugCheckParameter2 + 4240) = 0i64;
*(_QWORD *)(BugCheckParameter2 + 4232) = 0i64;
CmpWakeWriteQueueWaiters((PVOID)(BugCheckParameter2 + 4232), v29);
LOBYTE(Ptr_high) = Ptr_high | 0x10;
HvUnlockHiveFlusherExclusive(BugCheckParameter2);
CmpUnlockRegistry();
}
if( (Ptr & 0x40) != 0 )
{
CmpLogFlushPhaseStart(v27, (PLIST_ENTRY)5, v28);
LOBYTE(v35) = 1;
valid = HvWriteHivePrimaryFile((_HHIVE *)BugCheckParameter2, v35, v22);
CmpLogFlushPhaseEnd(v36, 5, (unsigned int)valid);
if( valid < 0 )
goto LABEL_46;
LOBYTE(Ptr_high) = Ptr_high | 0x20;
}
if( (Ptr & 0x100) != 0 )
{
CmpLogFlushPhaseStart(v27, (PLIST_ENTRY)6, v28);
valid = HvValidateOrInvalidatePrimaryFileHeader(BugCheckParameter2, 1, 1, v22);
CmpLogFlushPhaseEnd(v39, 6, (unsigned int)valid);
if( valid < 0 )
goto LABEL_46;
LOBYTE(Ptr_high) = Ptr_high | 0x20;
HvTruncateAllLogFilesIfRequired((UINT64 *)BugCheckParameter2);
}
if( (Ptr & 0x200) != 0 && (Ptr_high & 0x20) == 0 )
{
CmpLogFlushPhaseStart(v27, (PLIST_ENTRY)7, v28);
if( (int)CmpFileFlushAndPurge(BugCheckParameter2, 0i64) >= 0 )
LOBYTE(Ptr_high) = Ptr_high | 0x20;
CmpLogFlushPhaseEnd(v40, 7, (Ptr_high & 0x20) == 0 ? 0xC0000001 : 0);
}
valid = 0;
LABEL_46:
CmpLockRegistry();
HvLockHiveFlusherExclusive(BugCheckParameter2);
if( valid < 0 && (Ptr & 0x80u) != 0 && (Ptr_high & 1) == 0 )
*(_DWORD *)(BugCheckParameter2 + 4268) = v18;
if( (Ptr_high & 0x20) != 0 )
{
*(_DWORD *)(BugCheckParameter2 + 4264) |= 1u;
*(_DWORD *)(BugCheckParameter2 + 4268) = 0;
}
if( valid < 0 )
{
if( (Ptr_high & 2) != 0 && (Ptr & 0x400) != 0 )
{
*(_DWORD *)(BugCheckParameter2 + 176) -= LogEntrySize;
--*(_DWORD *)(BugCheckParameter2 + 168);
LOBYTE(Ptr_high) = Ptr_high & 0xFD;
}
goto LABEL_52;
}
if( (Ptr & 0x800) != 0 )
{
*(_QWORD *)(BugCheckParameter2 + 4184) = KeQueryUnbiasedInterruptTime();
if( (Ptr & 0x1000) != 0 )
goto LABEL_101;
CmpArmLazyWriter(1, 0i64, 0);
}
if( (Ptr & 0x1000) == 0 )
{
LABEL_52:
v30 = (Ptr >> 6) & 1;
if( v30 )
{
if( valid < 0 )
{
HvFoldBackUnreconciledData(BugCheckParameter2);
}
else
{
HvUnCOWReconciledPages(BugCheckParameter2);
HvFreeUnreconciledData((_HHIVE *)BugCheckParameter2);
if( (Ptr & 1) != 0 && (Ptr_high & 0x10) == 0 )
{
HvResetLogFileStatusAll(BugCheckParameter2);
*(_DWORD *)(BugCheckParameter2 + 176) = 0;
if( HvIsCurrentLogSwappable(BugCheckParameter2) )
HvSwapLogFiles(BugCheckParameter2);
}
else
{
v37 = *(_DWORD *)(BugCheckParameter2 + 164);
if( (unsigned int)(v37 - 4) <= 1 )
*(_BYTE *)((unsigned int)HvpLogTypeToLogArrayIndex(5 - (unsigned int)(v37 != 4))
+ BugCheckParameter2
+ 188) = 0;
}
}
}
if( (Ptr & 0x110) != 0 )
HvFreeUnreconciledData((_HHIVE *)BugCheckParameter2);
if( (Ptr & 8) != 0 && (Ptr_high & 4) == 0 )
{
if( (Ptr_high & 2) != 0 )
{
if( !v30 )
{
RtlMergeBitMaps((RTL_BITMAP *)(BugCheckParameter2 + 112), (RTL_BITMAP *)(BugCheckParameter2 + 1680));
*(_DWORD *)(BugCheckParameter2 + 128) = RtlNumberOfSetBits((PRTL_BITMAP)(BugCheckParameter2 + 112));
}
HvFreeDirtyData(BugCheckParameter2);
}
else
{
HvFoldBackDirtyData((_HHIVE *)BugCheckParameter2);
}
}
goto LABEL_61;
}
LABEL_101:
CmpArmLazyWriter(1, 0i64, 1);
goto LABEL_52;
}
Ptr &= ~0x80u;
}
v18 = v60;
Ptr_high = HIDWORD(v60);
goto LABEL_30;
}
HvLockHiveWriter(BugCheckParameter2);
if( HvMarkDirty(BugCheckParameter2, 0i64, 4096i64) )
{
HvUnlockHiveWriter(BugCheckParameter2);
goto LABEL_25;
}
HvUnlockHiveWriter(BugCheckParameter2);
valid = -1073741823;
LABEL_122:
LOBYTE(Ptr_high) = BYTE4(v59.Ptr);
LABEL_61:
*(_QWORD *)&EventDescriptor_8.Id = 0i64;
EventDescriptor = 0i64;
if( (Ptr & 1) == 0 || (v31 = 1, (Ptr_high & 0x10) != 0) )
v31 = 0;
v32 = (Ptr & 2) != 0;
LOBYTE(Flags) = v31;
if( v31 )
{
*(_QWORD *)&EventDescriptor_8.Id = *(_QWORD *)(BugCheckParameter2 + 4240);
*(_QWORD *)(BugCheckParameter2 + 4240) = 0i64;
*(_QWORD *)(BugCheckParameter2 + 4232) = 0i64;
}
if( v32 )
{
EventDescriptor = *(PRKEVENT *)(BugCheckParameter2 + 4256);
*(_QWORD *)(BugCheckParameter2 + 4256) = 0i64;
*(_QWORD *)(BugCheckParameter2 + 4248) = 0i64;
}
HvUnlockHiveFlusherExclusive(BugCheckParameter2);
CmpUnlockRegistry();
if( (_BYTE)Flags )
CmpWakeWriteQueueWaiters((PVOID)(BugCheckParameter2 + 4232), *(PRKEVENT *)&EventDescriptor_8.Id);
if( v32 )
CmpWakeWriteQueueWaiters((PVOID)(BugCheckParameter2 + 4248), EventDescriptor);
LABEL_71:
CmpTraceHiveFlushStop((unsigned int)valid, v7, v8);
if( (unsigned int)dword_140C02130 > 4 )
{
*(_DWORD *)&EventDescriptor_8.Id = valid;
p_EventDescriptor_8 = &EventDescriptor_8;
v63 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)byte_14002239D,
0i64,
0i64,
3u,
&v59);
}
return(unsigned int)valid;
}Referenced by:
CmFreezeRegistry
CmReplaceKey
CmShutdownSystem
CmpCompleteUnloadKey
CmpDoFlushAll
CmpDoFlushNextHive
CmpDoReconcileNextHive
CmpFinishSystemHivesLoad
CmpInitHiveFromFile
CmpLoadHiveThread
CmpLoadKeyCommon
CmpMountPreloadedHives
CmpTransMgrPrepare
CmpTransMgrSyncHive
NtFlushKey