NtEnumerateKey

NTSTATUS __stdcall NtEnumerateKey(
        VOID *KeyHandle,
        UINT64 Index,
        _KEY_INFORMATION_CLASS KeyInformationClass,
        VOID *KeyInformation,
        UINT64 Length,
        UINT64 *ResultLength){
  unsigned int v8; 
  _ETHREAD *CurrentThread; 
  VOID *v11; 
  UINT8 v12; 
  INT64 v13; 
  unsigned int v14; 
  NTSTATUS v15; 
  _ADAPTER_OBJECT *v16; 
  unsigned int v17; 
  __int64 v18; 
  _ETHREAD *v19; 
  int v20; 
  unsigned int v21; 
  _DMA_OPERATIONS *v22; 
  __int64 v23; 
  char PreviousMode; 
  char v26; 
  char v27; 
  UINT8 v28; 
  unsigned int v29; 
  PADAPTER_OBJECT DmaAdapter; 
  _DMA_OPERATIONS *DmaOperations; 
  unsigned int v32[4]; 
  _DMA_OPERATIONS *v33; 
  PADAPTER_OBJECT v34; 
  INT64 v35[2]; 
  PVOID v36; 
  PVOID Object; 
  PVOID v38; 
  _SLIST_ENTRY *v39; 
  NTSTATUS v40; 
  int v41; 
  _SLIST_ENTRY **v42; 
  NTSTATUS v43; 
  __int128 v44; 
  __int64 v45; 
  int v46; 
  _SLIST_ENTRY *Argument[9]; 
  _LARGE_INTEGER TimeStamp[2]; 
  __int128 v49; 
  VOID *Src[2]; 
  char v51; 
  char v52[71]; 

  v8 = Index;
  v29 = Index;
  v32[2] = Index;
  memset(v52, 0i64, sizeof(v52));
  *(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
  v49 = 0i64;
  DmaOperations = 0i64;
  v33 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
  v26 = 0;
  v27 = 0;
  memset(Argument, 0i64, 0x40u);
  DmaAdapter = 0i64;
  v32[0] = 0;
  *(_OWORD *)Src = 0i64;
  v51 = 0;
  v35[1] = (INT64)v35;
  v35[0] = (INT64)v35;
  v34 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v12 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  v28 = v12;
  if( !v12 )
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( !v12 )
  {
    v15 = -1073741431;
    v22 = 0i64;
    goto LABEL_31;
  }
  if( (unsigned int)KeyInformationClass > KeyFullInformation )
  {
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7)
      && KeyHandle
      && (PreviousMode = KeGetCurrentThread()->PreviousMode,
          v36 = 0i64,
          ObReferenceObjectByHandle(KeyHandle, 0i64, (_OBJECT_TYPE *)CmKeyObjectType, PreviousMode, &v36, 0i64) >= 0) )
    {
      v22 = (_DMA_OPERATIONS *)*((_QWORD *)v36 + 1);
      HalPutDmaAdapter((PADAPTER_OBJECT)v36);
    }
    else
    {
      v22 = 0i64;
    }
    v15 = -1073741811;
    goto LABEL_31;
  }
  v14 = KeGetCurrentThread()->PreviousMode;
  Argument[8] = 0i64;
  Object = 0i64;
  v15 = ObReferenceObjectByHandle(KeyHandle, 8ui64, (_OBJECT_TYPE *)CmKeyObjectType, v14, &Object, 0i64);
  v16 = (_ADAPTER_OBJECT *)Object;
  v38 = Object;
  if( v15 >= 0 )
  {
    if( *(_DWORD *)Object == 1803104306 )
    {
      DmaAdapter = (PADAPTER_OBJECT)Object;
      v16 = 0i64;
      v38 = 0i64;
      v15 = 0;
    }
    else
    {
      v15 = -1073741816;
    }
  }
  if( v16 )
    HalPutDmaAdapter(v16);
  if( v15 < 0 )
  {
    v8 = v29;
    v22 = 0i64;
    goto LABEL_31;
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
  {
    DmaOperations = DmaAdapter->AdapterObject.DmaHeader.DmaOperations;
    v33 = DmaOperations;
  }
  if( (_BYTE)v14 == 1 )
  {
    v17 = Length;
    ProbeForWrite((UINT64)KeyInformation, (unsigned int)Length, 4i64);
    v18 = (__int64)ResultLength;
    if( (unsigned __int64)ResultLength >= 0x7FFFFFFF0000i64 )
      v18 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v18 = *(_DWORD *)v18;
  }
  else
  {
    v17 = Length;
  }
  v19 = (_ETHREAD *)KeGetCurrentThread();
  --v19->Tcb.KernelApcDisable;
  v27 = 1;
  if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, (INT64)v11, v13) )
  {
    Argument[0] = (_SLIST_ENTRY *)DmaAdapter;
    Argument[1] = (_SLIST_ENTRY *)__PAIR64__(KeyInformationClass, v29);
    Argument[2] = (_SLIST_ENTRY *)KeyInformation;
    LODWORD(Argument[3]) = v17;
    Argument[4] = (_SLIST_ENTRY *)ResultLength;
    v20 = CmpCallCallBacksEx(RegNtEnumerateKey, Argument, 0i64, 1, RegNtPostEnumerateKey, (INT64)DmaAdapter, (INT64)v35);
    v15 = v20;
    if( v20 < 0 )
    {
      v8 = v29;
      v22 = DmaOperations;
      if( v20 == -1073740541 )
        v15 = 0;
      goto LABEL_31;
    }
    v26 = 1;
  }
  v15 = CmKeyBodyRemapToVirtualForEnum((CM_KEY_BODY **)&DmaAdapter, (CM_KEY_BODY **)(unsigned __int8)v14);
  if( v15 < 0 || (v15 = CmpBounceContextStart((INT64)Src, (struct SLIST_ENTRY *)KeyInformation, v17, v14, 0), v15 < 0) )
  {
    v8 = v29;
LABEL_49:
    v22 = DmaOperations;
    goto LABEL_31;
  }
  v8 = v29;
  v15 = CmEnumerateKey(DmaAdapter, (__int64)v34, v29, KeyInformationClass, (__int64)Src[1], v17, v32);
  if( v15 < 0 && v15 != -2147483643 && v15 != -1073741789 )
    goto LABEL_49;
  v21 = v32[0];
  *(_DWORD *)ResultLength = v32[0];
  if( v15 != -1073741789 )
  {
    if( v17 >= v21 )
      v17 = v21;
    v11 = Src[1];
    if( Src[0] != Src[1] )
      memmove(Src[0], Src[1], v17);
  }
  v22 = DmaOperations;
LABEL_31:
  if( v34 )
    HalPutDmaAdapter(v34);
  if( v26
    && dword_140C5083C
    && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, (INT64)v11, v13)
    && (INT64 *)v35[0] != v35 )
  {
    v41 = 0;
    v44 = 0i64;
    v45 = 0i64;
    v46 = 0;
    v39 = (_SLIST_ENTRY *)DmaAdapter;
    v40 = v15;
    v43 = v15;
    v42 = Argument;
    CmpCallCallBacksEx(RegNtPostEnumerateKey, &v39, 0i64, 0, RegNtPostEnumerateKey, (INT64)DmaAdapter, (INT64)v35);
    v15 = v43;
  }
  if( v27 )
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  CmpBounceContextCleanup((INT64)Src);
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v23) = 17;
    (*(void(__fastcall **)(__int64, _LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _QWORD))((char *)&NlsMbCodePageTag
                                                                                                 + 7))(
      v23,
      TimeStamp,
      (unsigned int)v15,
      v8,
      v22,
      0i64);
  }
  if( v28 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return v15;
}

Referenced by: