CmpCreateKeyBody
INT64 __fastcall CmpCreateKeyBody(
volatile INT64 *a1,
INT8 a2,
INT64 a3,
INT64 a4,
CHAR a5,
INT64 a6,
INT64 a7,
INT64 a8){
INT64 v9;
_QUAD *p_Body;
signed __int64 v13;
_OBJECT_TYPE *v14;
struct _KPRCB *CurrentPrcb;
_GENERAL_LOOKASIDE *P;
_OBJECT_CREATE_INFORMATION *v17;
NTSTATUS v18;
unsigned int DefaultNonPagedPoolCharge;
_OBJECT_HEADER *v20;
unsigned int v21;
int v22;
_QUAD *v23;
CHAR v24;
unsigned int v25;
__int64 UseThisFieldToCopy;
__int64 v27;
_QUAD **v28;
char v29;
_GENERAL_LOOKASIDE *L;
__int64 Size;
void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *);
__int64 Tag;
__int64 Type;
int v36;
INT64 v37;
__int64 v38;
struct _KPRCB *v39;
_GENERAL_LOOKASIDE *v40;
VOID *SecurityDescriptor;
struct _KPRCB *v42;
_GENERAL_LOOKASIDE *v43;
_OBJECT_CREATE_INFORMATION *ObjectCreateInfo;
INT64 UseLookaside;
_OB_EXTENDED_CREATION_INFO ExtendedInfo;
_OBJECT_HEADER *ReturnedObjectHeader;
INT64 v48;
_UNICODE_STRING CapturedObjectName;
v9 = 0i64;
v48 = 0i64;
p_Body = 0i64;
v13 = _InterlockedIncrement64(a1);
if( !v13 )
KeBugCheckEx(0x51u, (PVOID)0x24, (PVOID)a1, 0i64, 0i64);
if( v13 == 1 )
KeBugCheckEx(0x51u, (PVOID)0x15, 0i64, 0i64, 0i64);
if( a4 )
{
if( *(_QWORD *)(a4 + 56) )
{
v9 = *(_QWORD *)(a4 + 56);
v36 = CmpTransReferenceTransaction(v9);
v21 = v36;
if( v36 < 0 )
{
CmpRecordParseFailure(a3, 131840i64, (unsigned int)v36);
LABEL_47:
CmpDereferenceKeyControlBlockUnsafe(a1);
return v21;
}
}
else
{
v48 = a4 + 88;
}
}
v14 = (_OBJECT_TYPE *)CmKeyObjectType;
ExtendedInfo.AllowExtendedUserInfo = 0;
ReturnedObjectHeader = 0i64;
CurrentPrcb = KeGetCurrentPrcb();
ExtendedInfo.AllowHandleRevocation = 1;
CapturedObjectName = 0i64;
P = CurrentPrcb->PPLookasideList[4].P;
++P->TotalAllocates;
v17 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&P->ListHead);
if( !v17 )
{
++P->AllocateMisses;
L = CurrentPrcb->PPLookasideList[4].L;
++L->TotalAllocates;
v17 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&L->ListHead);
if( !v17 )
{
Size = L->Size;
AllocateEx = L->AllocateEx;
Tag = L->Tag;
Type = (unsigned int)L->Type;
++L->AllocateMisses;
v17 = (_OBJECT_CREATE_INFORMATION *)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(
Type,
Size,
Tag);
if( !v17 )
{
v21 = -1073741670;
goto LABEL_49;
}
}
}
v17->Attributes = CurrentPrcb->Number;
LODWORD(UseLookaside) = 0;
v18 = ObpCaptureObjectCreateInformation(a2, a2, 0i64, &CapturedObjectName, v17, UseLookaside);
if( v18 < 0 )
{
v39 = KeGetCurrentPrcb();
v40 = v39->PPLookasideList[4].P;
++v40->TotalFrees;
if( LOWORD(v40->ListHead.Alignment) < v40->Depth
|| (++v40->FreeMisses,
v40 = v39->PPLookasideList[4].L,
++v40->TotalFrees,
LOWORD(v40->ListHead.Alignment) < v40->Depth) )
{
RtlpInterlockedPushEntrySList(&v40->ListHead, (PSLIST_ENTRY)v17);
}
else
{
++v40->FreeMisses;
((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v40->FreeEx)(v17);
}
goto LABEL_12;
}
if( (v17->Attributes & v14->TypeInfo.InvalidAttributes) != 0 )
{
v18 = -1073741811;
goto LABEL_58;
}
if( (v17->Attributes & 0x10) != 0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, a2) )
{
v18 = -1073741727;
goto LABEL_58;
}
DefaultNonPagedPoolCharge = v14->TypeInfo.DefaultNonPagedPoolCharge;
v17->PagedPoolCharge = v14->TypeInfo.DefaultPagedPoolCharge;
v17->NonPagedPoolCharge = DefaultNonPagedPoolCharge;
LODWORD(ObjectCreateInfo) = 104;
v18 = ObpAllocateObject(
v17,
a2,
v14,
&CapturedObjectName,
(UINT64)ObjectCreateInfo,
&ReturnedObjectHeader,
&ExtendedInfo);
if( v18 < 0 )
{
LABEL_58:
if( CapturedObjectName.Buffer )
ObpFreeObjectNameBuffer(&CapturedObjectName);
SecurityDescriptor = v17->SecurityDescriptor;
if( SecurityDescriptor )
{
SeReleaseSecurityDescriptor(SecurityDescriptor, v17->ProbeMode, 1u);
v17->SecurityDescriptor = 0i64;
}
v42 = KeGetCurrentPrcb();
v43 = v42->PPLookasideList[4].P;
++v43->TotalFrees;
if( LOWORD(v43->ListHead.Alignment) >= v43->Depth
&& (++v43->FreeMisses,
v43 = v42->PPLookasideList[4].L,
++v43->TotalFrees,
LOWORD(v43->ListHead.Alignment) >= v43->Depth) )
{
++v43->FreeMisses;
((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v43->FreeEx)(v17);
}
else
{
RtlpInterlockedPushEntrySList(&v43->ListHead, (PSLIST_ENTRY)v17);
}
goto LABEL_12;
}
v20 = ReturnedObjectHeader;
if( ObpTraceFlags )
{
ObpRegisterObject(ReturnedObjectHeader);
ObpPushStackInfo(v20, 1u, 1ui64, 0x746C6644ui64);
}
p_Body = &v20->Body;
LABEL_12:
v21 = v18;
if( v18 < 0 )
{
LABEL_49:
CmpRecordParseFailure(a3, 132096i64, v21);
v29 = 1;
goto LABEL_30;
}
memset(p_Body, 0i64, 0x68u);
WORD1(p_Body[6].DoNotUseThisField) = *(_WORD *)(a3 + 20);
p_Body[1].UseThisFieldToCopy = (__int64)a1;
p_Body[3].UseThisFieldToCopy = (__int64)PsGetCurrentThreadProcessId();
LODWORD(p_Body[12].DoNotUseThisField) = -1;
if( (a1[23] & 0x400000) != 0 )
{
v38 = *((int *)a1 + 24);
LODWORD(p_Body->DoNotUseThisField) = v38;
*(_QWORD *)(a3 + 56) = v38;
}
else
{
LODWORD(p_Body->DoNotUseThisField) = 1803104306;
}
if( a4 )
{
v37 = v48;
p_Body[7].UseThisFieldToCopy = v9;
v9 = 0i64;
p_Body[8].UseThisFieldToCopy = v37;
}
p_Body[10].UseThisFieldToCopy = (__int64)&p_Body[9];
p_Body[9].UseThisFieldToCopy = (__int64)&p_Body[9];
if( (*(_DWORD *)(a3 + 24) & 0x10) != 0 )
LOWORD(p_Body[6].DoNotUseThisField) |= 0x10u;
v22 = *((_DWORD *)a1 + 46);
if( (v22 & 0x400000) != 0 )
{
LABEL_29:
v21 = 0;
*(_QWORD *)a7 = p_Body;
v29 = 0;
*(_BYTE *)a8 = (v22 & 0x400000) != 0;
}
else
{
v23 = p_Body + 4;
LABEL_21:
v24 = a5;
do
{
p_Body[5].UseThisFieldToCopy = (__int64)&p_Body[4];
v25 = 0;
v23->UseThisFieldToCopy = (__int64)v23;
do
{
if( !_InterlockedCompareExchange64(
(volatile signed __int64 *)(p_Body[1].UseThisFieldToCopy + 8i64 * v25 + 136),
(signed __int64)p_Body,
0i64) )
goto LABEL_28;
++v25;
}
while( v25 < 4 );
UseThisFieldToCopy = p_Body[1].UseThisFieldToCopy;
if( v24 )
{
v27 = UseThisFieldToCopy + 120;
v28 = *(_QUAD ***)(UseThisFieldToCopy + 128);
if( *v28 != (_QUAD *)v27 )
__fastfail(3u);
v23->UseThisFieldToCopy = v27;
p_Body[5].UseThisFieldToCopy = (__int64)v28;
*v28 = v23;
*(_QWORD *)(v27 + 8) = v23;
LABEL_28:
v22 = *((_DWORD *)a1 + 46);
goto LABEL_29;
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)(UseThisFieldToCopy + 48), 1i64, 17i64) == 17 )
{
*(_QWORD *)(UseThisFieldToCopy + 56) = KeGetCurrentThread();
a5 = 1;
goto LABEL_21;
}
CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)p_Body[1].UseThisFieldToCopy);
CmpLockKcbExclusive(p_Body[1].UseThisFieldToCopy);
v24 = 1;
}
while( !CmpIsKeyStackDeleted(a6, a4) );
v21 = -1073741444;
v29 = 1;
}
LABEL_30:
if( v9 )
CmpTransDereferenceTransaction(v9);
if( v29 )
goto LABEL_47;
return v21;
}Referenced by:
CmpDoParseKey
CmpStartSiloRegistryNamespace