CmSaveMergedKeys
NTSTATUS __stdcall CmSaveMergedKeys(
_CM_KEY_BODY *HighPrecedenceKeyBody,
_CM_KEY_BODY *LowPrecedenceKeyBody,
PVOID FileHandle){
char v3;
_CM_KEY_CONTROL_BLOCK *KeyControlBlock;
_CM_KEY_CONTROL_BLOCK *v5;
INT64 v6;
UINT64 KeyHive;
_CM_KEY_NODE *v8;
_CM_KEY_NODE *v9;
UINT64 v10;
char v11;
NTSTATUS v12;
_CM_KEY_CONTROL_BLOCK *v13;
_CM_KEY_CONTROL_BLOCK *v14;
unsigned int v15;
INT64 v16;
INT64 v17;
unsigned int v18;
_CM_KEY_NODE *v19;
UINT64 v20;
NTSTATUS v21;
const GUID *v22;
INT64 a5;
INT64 a5a;
INT64 a5b;
CHAR TargetKeyNode;
_CM_KEY_NODE *TargetKeyNodea;
_CM_KEY_NODE *TargetKeyNodeb;
UINT64 v30;
UINT8 v31;
char v32;
char a3;
_CM_KEY_CONTROL_BLOCK *a3_7;
_CM_KEY_CONTROL_BLOCK *Kcb2;
unsigned int v36;
int v37[2];
int v38[2];
UINT64 a2;
__int64 v40;
_CM_KEY_BODY *v41;
_CM_KEY_BODY *v42;
UUID v43;
UUID Uuid;
struct _EVENT_DATA_DESCRIPTOR v45;
__int64 *v46;
__int64 v47;
v41 = HighPrecedenceKeyBody;
v40 = (__int64)FileHandle;
v38[1] = 0;
v37[1] = 0;
KeyControlBlock = HighPrecedenceKeyBody->KeyControlBlock;
v5 = LowPrecedenceKeyBody->KeyControlBlock;
v38[0] = -1;
v37[0] = -1;
Uuid = 0i64;
a3_7 = KeyControlBlock;
v6 = 0i64;
v43 = 0i64;
KeyHive = (UINT64)KeyControlBlock->KeyHash.KeyHive;
v8 = 0i64;
v9 = 0i64;
v10 = (UINT64)v5->KeyHash.KeyHive;
v11 = 0;
LODWORD(a2) = KeyControlBlock->KeyHash.KeyCell;
LODWORD(KeyControlBlock) = v5->KeyHash.KeyCell;
Kcb2 = v5;
a3 = v3;
v42 = LowPrecedenceKeyBody;
v36 = (unsigned int)KeyControlBlock;
v32 = 0;
v12 = CmpUuidCreate(&Uuid);
if( v12 < 0 )
goto LABEL_41;
v12 = CmpUuidCreate(&v43);
if( v12 < 0 )
goto LABEL_41;
if( v10 == CmpMasterHive || KeyHive == CmpMasterHive )
{
if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000000i64) )
{
v40 = 0x1000000i64;
v46 = &v40;
v47 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02130,
(unsigned __int8 *)byte_140022D90,
0i64,
v22,
3u,
&v45);
}
v12 = -1073741790;
goto LABEL_37;
}
if( v10 == KeyHive )
{
v12 = -1073741811;
LABEL_41:
v13 = Kcb2;
goto LABEL_42;
}
CmpLockRegistry();
v13 = Kcb2;
v14 = a3_7;
CmpLockTwoKcbsShared(a3_7, Kcb2);
v32 = 1;
if( a3_7->LayerHeight || Kcb2->LayerHeight )
{
CmpLogUnsupportedOperation(19i64);
v12 = -1073741822;
goto LABEL_43;
}
if( CmpIsKeyDeletedForKeyBody((__int64)v41, 0i64) || CmpIsKeyDeletedForKeyBody((__int64)v42, 0i64) )
{
v12 = -1073741444;
goto LABEL_43;
}
if( (*(_DWORD *)(KeyHive + 160) & 2) != 0 && *(_DWORD *)(KeyHive + 104)
|| (*(_DWORD *)(v10 + 160) & 2) != 0 && *(_DWORD *)(v10 + 104) )
{
v12 = -1073741811;
goto LABEL_43;
}
v6 = CmpCreateTemporaryHive(&Uuid, &v43);
if( !v6 )
{
v12 = -1073741670;
goto LABEL_43;
}
v12 = CmpBlockTwoHiveWrites(v10, KeyHive, 0);
if( v12 >= 0 )
{
v11 = 6;
CmLockHiveSecurityShared((_CMHIVE *)KeyHive);
v15 = a2;
LOBYTE(v16) = a3;
LODWORD(a5) = 3;
v12 = CmpDoAccessCheckOnSubtree(KeyHive, (unsigned int)a2, v16, 131097i64, a5);
CmUnlockHiveSecurity(KeyHive);
if( v12 < 0 )
goto LABEL_42;
CmLockHiveSecurityShared((_CMHIVE *)v10);
LOBYTE(v17) = a3;
LODWORD(a5a) = 3;
v12 = CmpDoAccessCheckOnSubtree(v10, v36, v17, 131097i64, a5a);
CmUnlockHiveSecurity(v10);
if( v12 < 0 )
goto LABEL_42;
HvLockHiveFlusherExclusive(v6);
LODWORD(v30) = 0;
v11 = 7;
v18 = CmpCopyKeyPartial(KeyHive, (unsigned int)a2, v6, 0xFFFFFFFFui64, 6, TargetKeyNode, v30);
if( v18 == -1
|| (LODWORD(TargetKeyNodea) = 0,
*(_DWORD *)(*(_QWORD *)(v6 + 64) + 36i64) = v18,
!CmpCopySyncTree(KeyHive, v15, v6, v18, 2, (INT64)TargetKeyNodea)) )
{
v12 = -1073741670;
LABEL_42:
v14 = a3_7;
goto LABEL_43;
}
HvUnlockHiveFlusherExclusive(KeyHive);
v11 = 5;
v9 = (_CM_KEY_NODE *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(v10 + 8))(v10, v36, v37);
if( !v9 )
goto LABEL_25;
v19 = (_CM_KEY_NODE *)(*(__int64(__fastcall **)(INT64, _QWORD, int *))(v6 + 8))(v6, v18, v38);
v8 = v19;
if( v19 )
{
LODWORD(a5b) = v18;
if( (unsigned __int8)CmpMergeKeyValues((_HHIVE *)v10, v20, v9, (_HHIVE *)v6, a5b, v19, v31) )
{
(*(void(__fastcall **)(UINT64, int *))(v10 + 16))(v10, v37);
(*(void(__fastcall **)(INT64, int *))(v6 + 16))(v6, v38);
LODWORD(TargetKeyNodeb) = 2;
if( CmpCopySyncTree(v10, v36, v6, v18, 2, (INT64)TargetKeyNodeb) )
{
HvUnlockHiveFlusherExclusive(v10);
HvUnlockHiveFlusherExclusive(v6);
v13 = Kcb2;
v11 = 0;
v14 = a3_7;
CmpUnlockTwoKcbs(a3_7, Kcb2);
CmpUnlockRegistry();
*(_QWORD *)(v6 + 1552) = v40;
v32 = 0;
v21 = HvWriteExternal(v6);
*(_QWORD *)(v6 + 1552) = 0i64;
v12 = v21;
goto LABEL_43;
}
LABEL_25:
v12 = -1073741670;
goto LABEL_41;
}
}
v12 = -1073741670;
LABEL_37:
if( v9 )
(*(void(__fastcall **)(UINT64, int *))(v10 + 16))(v10, v37);
if( v8 )
(*(void(__fastcall **)(INT64, int *))(v6 + 16))(v6, v38);
goto LABEL_41;
}
LABEL_43:
if( (v11 & 4) != 0 )
HvUnlockHiveFlusherExclusive(v10);
if( (v11 & 2) != 0 )
HvUnlockHiveFlusherExclusive(KeyHive);
if( (v11 & 1) != 0 )
HvUnlockHiveFlusherExclusive(v6);
if( v32 )
{
CmpUnlockTwoKcbs(v14, v13);
CmpUnlockRegistry();
}
if( v6 )
CmpDestroyHive((PVOID)v6);
return v12;
}Referenced by:
NtSaveMergedKeys