VrpHandleIoctlLoadDifferencingHive

NTSTATUS __stdcall VrpHandleIoctlLoadDifferencingHive(PVOID Data, UINT64 DataLength, INT8 RequestorMode){
  unsigned int v3; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  int v8; 
  unsigned int v9; 
  unsigned int v10; 
  void *v11; 
  int JobSilo; 
  WCHAR *v13; 
  SIZE_T v14; 
  WCHAR *v15; 
  PWCHAR v16; 
  VOID *PoolWithTag; 
  SIZE_T Tag; 
  UINT64 Taga; 
  WCHAR *Object; 
  PVOID *Objecta; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  WCHAR *v24; 
  void *Src[2]; 
  UNICODE_STRING NextLayerKeyPath; 
  UNICODE_STRING TargetHivePath; 
  _EJOB *Silo; 
  PVOID v29; 
  PWCHAR FullPath; 
  v3 = DataLength;
  v29 = 0i64;
  FullPath = 0i64;
  Silo = 0i64;
  NextLayerKeyPath = 0i64;
  TargetHivePath = 0i64;
  *(_OWORD *)Src = 0i64;
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, RequestorMode)
    || !SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, RequestorMode) )
  {
    return -1073741727;
  }
  if( v3 < 0x30 )
    return -1073741811;
  v6 = *((unsigned __int16 *)Data + 10);
  if( (v6 & 1) != 0 )
    return -1073741811;
  v7 = *((unsigned __int16 *)Data + 11);
  if( (v7 & 1) != 0 )
    return -1073741811;
  v8 = *((unsigned __int16 *)Data + 12);
  if( (v8 & 1) != 0 )
    return -1073741811;
  if( !(_WORD)v6 )
    return -1073741811;
  if( !(_WORD)v7 )
    return -1073741811;
  v9 = v6 + 40;
  v10 = v9 + v7;
  if( v9 > v9 + (unsigned int)v7 || v10 > v10 + v8 || v3 < v10 + v8 || (*((_DWORD *)Data + 3) & 1) != 0 && !(_WORD)v8 )
    return -1073741811;
  WORD1(Src[0]) = *((_WORD *)Data + 10);
  LOWORD(Src[0]) = v6;
  Src[1] = (char *)Data + 40;
  TargetHivePath.MaximumLength = v7;
  TargetHivePath.Length = v7;
  v11 = *(void **)Data;
  TargetHivePath.Buffer = (wchar_t *)((char *)Data + 2 * (v6 >> 1) + 40);
  NextLayerKeyPath.MaximumLength = v8;
  NextLayerKeyPath.Length = v8;
  NextLayerKeyPath.Buffer = &TargetHivePath.Buffer[v7 >> 1];
  JobSilo = ObReferenceObjectByHandleWithTag(v11, 6u, (POBJECT_TYPE)PsJobType, RequestorMode, 0x52566D43u, &v29, 0i64);
  if( JobSilo >= 0 )
  {
    JobSilo = PsGetJobSilo((_EJOB *)v29, &Silo);
    if( JobSilo >= 0 )
    {
      if( PsIsThreadInSilo((__int64)KeGetCurrentThread(), (__int64)Silo) )
      {
        JobSilo = -1073741811;
      }
      else
      {
        JobSilo = PsGetPermanentSiloContext(Silo, (unsigned int)VrpSiloContextSlot, (PVOID *)&FullPath);
        if( JobSilo < 0 )
          goto LABEL_22;
        v16 = FullPath;
        VrpLockJobContextExclusive(
          FullPath,
          v13,
          v14,
          v15,
          Tag,
          Object,
          (SIZE_T)HandleInformation,
          v24,
          (SIZE_T)Src[0],
          (INT64)Src[1],
          *(PWCHAR *)&NextLayerKeyPath.Length);
        if( *((_DWORD *)v16 + 21) )
        {
          JobSilo = -1073741738;
        }
        else
        {
          LODWORD(Objecta) = (*((_DWORD *)Data + 3) >> 1) & 1;
          LODWORD(Taga) = *((_DWORD *)Data + 3) & 1;
          JobSilo = VrpLoadDifferencingHive(
                      (UNICODE_STRING *)Src,
                      &TargetHivePath,
                      &NextLayerKeyPath,
                      *((unsigned int *)Data + 4),
                      Taga,
                      Objecta);
          if( JobSilo >= 0 )
          {
            PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)LOWORD(Src[0]) + 10, 0x67655256ui64);
            if( PoolWithTag )
            {
              *((_WORD *)PoolWithTag + 4) = Src[0];
              memmove((UINT8 *)PoolWithTag + 10, (UINT8 *)Src[1], LOWORD(Src[0]));
              *(_QWORD *)PoolWithTag = *((_QWORD *)v16 + 3);
              *((_QWORD *)v16 + 3) = PoolWithTag;
              VrpUnlockJobContextExclusive((INT64)v16);
              JobSilo = 0;
              goto LABEL_22;
            }
            JobSilo = -1073741670;
            VrpUnloadDifferencingHive((UNICODE_STRING *)Src);
          }
        }
        VrpUnlockJobContextExclusive((INT64)v16);
      }
    }
  }
LABEL_22:
  if( v29 )
    ObfDereferenceObjectWithTag(v29, 0x52566D43ui64);
  return JobSilo;
}

Referenced by: