CmSetValueKey
__int64 __fastcall CmSetValueKey(PVOID Object, _UNICODE_STRING *String2, int a3, VOID *a4, int a5, __int64 a6, char a7){
_UNICODE_STRING *v7;
INT64 v9;
void *v10;
char v11;
_LARGE_INTEGER v12;
int started;
char v14;
CM_TRANS *v15;
INT64 v16;
int v17;
INT64 v18;
char v19;
_CM_KEY_NODE *v20;
_HHIVE *v21;
__int64 v22;
UINT64 v23;
_HSTORAGE_TYPE v24;
_UNICODE_STRING *v25;
unsigned int Length;
size_t v27;
unsigned int Count;
INT64 v29;
unsigned int v30;
char v31;
VOID *v32;
__int64 v34;
unsigned int v35;
_HHIVE *v36;
unsigned int v37;
CM_KCB_UOW *v38;
int v39;
CM_KCB_UOW *UnitOfWork;
CM_KCB_UOW *v41;
__int64 v42;
__int64 v43;
INT64 v44;
_BOOL IsValueTombstone;
__int64 v46;
_HHIVE *v47;
ULONG_PTR v48;
PVOID Objecta;
PVOID HandleId;
_SE_CM_VALUE_AUDIT *ValueChangeInfo;
UINT64 AuditOperationType;
char ValueListDuplicated[3];
INT64 v54;
char PreviousMode;
size_t Size;
unsigned int v57;
SeCmAuditType v58;
UINT64 Index;
_HSTORAGE_TYPE v60;
_UNICODE_STRING *ValueName;
__int64 v62;
PVOID BugCheckParameter4;
INT64 v64[2];
__int128 v65;
__int64 v66;
VOID *Src;
VOID **v68;
CM_TRANS *CmTrans;
LIST_ENTRY DeferredPostAsync;
PVOID SecurityDescriptor;
PVOID v72;
INT64 a2[2];
_SE_CM_VALUE_AUDIT v74[4];
__int128 v75;
_KAPC_STATE ApcState;
v72 = (PVOID)a6;
v7 = String2;
ValueName = String2;
DeferredPostAsync.Blink = &DeferredPostAsync;
DeferredPostAsync.Flink = &DeferredPostAsync;
Src = a4;
*(_OWORD *)v64 = 0i64;
WORD1(v64[0]) = -1;
v9 = 0i64;
v57 = a3;
v68 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
BugCheckParameter4 = 0i64;
ValueListDuplicated[0] = 0;
v60 = 0;
*(_OWORD *)a2 = 0i64;
CmTrans = 0i64;
v65 = 0i64;
v66 = 0xFFFFFFFFi64;
v62 = 0xFFFFFFFFi64;
CmpInitializeDelayDerefContext(a2);
*(_OWORD *)v74 = 0i64;
Index = 0xFFFFFFFFi64;
v75 = 0i64;
v54 = 0xFFFFFFFFi64;
SecurityDescriptor = v10;
v58 = (int)v10;
PreviousMode = KeGetCurrentThread()->PreviousMode;
CmpAttachToRegistryProcess(&ApcState);
Size = a5;
while( 1 )
{
v11 = a7;
if( (*(&CmpDummyThreadEvent + 1056) & 1) != 0 )
{
v31 = 0;
v14 = 0;
v19 = 0;
started = -1073741431;
goto LABEL_45;
}
v12 = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
CmpLockRegistry();
v9 = *((_QWORD *)Object + 1);
if( (*(_DWORD *)(*(_QWORD *)(v9 + 32) + 160i64) & 0x100000) != 0 )
break;
started = CmpStartKcbStackForTopLayerKcb((INT64)v64, v9);
if( started < 0 )
goto LABEL_133;
if( *((_QWORD *)Object + 7) || *((_QWORD *)Object + 8) )
{
v14 = 1;
CmpLockKcbStackTopExclusiveRestShared((INT64)v64);
}
else
{
v14 = 0;
CmpLockKcbStackShared((INT64)v64);
}
if( *((_QWORD *)Object + 7) || *((_QWORD *)Object + 8) )
{
if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)Object, 0i64) )
{
v14 = 1;
v19 = 0;
started = -1073740763;
v31 = 1;
if( (*((_BYTE *)Object + 48) & 1) == 0 )
started = -1073741444;
goto LABEL_45;
}
started = CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)Object, &CmTrans);
if( started < 0 )
goto LABEL_128;
if( (*(_DWORD *)(*(_QWORD *)(v9 + 32) + 160i64) & 2) != 0 )
{
started = -1072103423;
LABEL_128:
v14 = 1;
v19 = 0;
v31 = 1;
goto LABEL_45;
}
}
LABEL_10:
v15 = CmTrans;
while( 1 )
{
if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)Object, v15) )
{
v14 = 1;
v19 = 0;
started = -1073740763;
if( (*((_BYTE *)Object + 48) & 1) == 0 )
started = -1073741444;
goto LABEL_43;
}
if( *(_BYTE *)(v9 + 65) == 1 )
goto LABEL_96;
if( v15 )
{
UnitOfWork = CmpAllocateUnitOfWork();
BugCheckParameter4 = UnitOfWork;
v41 = UnitOfWork;
if( !UnitOfWork )
{
v11 = a7;
v14 = 1;
v31 = 1;
started = -1073741670;
v19 = 0;
goto LABEL_47;
}
CmpTransEnlistUowInKcb((_CM_KCB_UOW *__ptr32)UnitOfWork, (_CM_KEY_CONTROL_BLOCK *__ptr32)v9);
started = CmpTransEnlistUowInCmTrans(v41, v15);
if( started < 0 )
goto LABEL_123;
if( !CmpLockIXLockIntent((UINT64 *)(v9 + 248), (INT64)v41)
|| !CmpLockIXLockExclusive(v9 + 264, (INT64)v41, 1i64) )
{
started = -1072103423;
LABEL_123:
v14 = 1;
LABEL_64:
v19 = 0;
LABEL_43:
v31 = 1;
LABEL_44:
v11 = a7;
goto LABEL_45;
}
HvLockHiveFlusherShared(*(_QWORD *)(v9 + 32));
v19 = 1;
if( !(unsigned __int8)CmpCloneKCBValueListForTrans(
(_CM_KEY_CONTROL_BLOCK *)v9,
v15,
(UINT8 *)ValueListDuplicated) )
{
started = -1073741670;
v14 = 1;
v31 = 1;
goto LABEL_44;
}
HvUnlockHiveFlusherShared(*(_QWORD *)(v9 + 32));
v7 = ValueName;
goto LABEL_16;
}
v16 = v9 + 248;
if( *(int *)(v9 + 248) < 0 )
break;
v16 = v9 + 264;
if( *(_DWORD *)(v9 + 264) )
break;
LABEL_16:
if( CmpIsKeyStackSymlink((INT64)v64)
&& (v57 != 6
|| (Size & 1) != 0
|| Size > 0xFFFF
|| !v7
|| !(unsigned __int8)RtlEqualUnicodeString(&CmSymbolicLinkValueName, v7, 1u)
|| (unsigned __int8)RtlIsSandboxedToken(InterruptControllerInvalid)) )
{
LABEL_96:
started = -1073741790;
goto LABEL_123;
}
if( *(_DWORD *)(v9 + 40) == -1 )
{
CmpUnlockKcbStack((INT64)v64);
v14 = 0;
started = CmpPromoteKey((__int64)v64, 0, 1);
if( started < 0 )
{
v31 = 1;
v19 = 0;
goto LABEL_44;
}
v14 = 1;
}
else
{
if( v14 )
goto LABEL_24;
v17 = CmpCompareNewValueDataAgainstKCBCache((_CM_KEY_CONTROL_BLOCK *)v9, v7, v57, Src, Size);
if( v17 != 1 )
{
v14 = 1;
if( !v17 )
{
started = 0;
goto LABEL_64;
}
if( *(struct _KTHREAD **)(v9 + 56) == KeGetCurrentThread() || CmpTryConvertKcbLockSharedToExclusive(v9) )
{
v15 = CmTrans;
LABEL_24:
v18 = *(_QWORD *)(v9 + 32);
++*(_QWORD *)(v9 + 304);
HvLockHiveFlusherShared(v18);
v19 = 1;
if( !v15 && !HvMarkCellDirty(*(PVOID *)(v9 + 32), (PVOID)*(unsigned int *)(v9 + 40), 0) )
{
started = -1073741443;
v14 = 1;
v31 = 1;
goto LABEL_44;
}
v20 = (_CM_KEY_NODE *)(*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(v9 + 32) + 8i64))(
*(_QWORD *)(v9 + 32),
*(unsigned int *)(v9 + 40),
&v66);
CmpUpdateKeyNodeAccessBits(*(_HHIVE **)(v9 + 32), v20, *(unsigned int *)(v9 + 40));
v21 = *(_HHIVE **)(v9 + 32);
if( v15 )
{
started = CmpFindNameInListWithStatus(
v21,
(_CHILD_LIST *)(v9 + 280),
ValueName,
0,
(unsigned int *)&Index + 1,
(unsigned int *)&Index);
if( (int)(started + 0x80000000) >= 0 )
goto LABEL_66;
}
else
{
started = CmpFindNameInListWithStatus(
v21,
&v20->ValueList,
ValueName,
0,
(unsigned int *)&Index + 1,
(unsigned int *)&Index);
if( (int)(started + 0x80000000) < 0 )
goto LABEL_28;
LABEL_66:
if( started != -1073741772 )
{
LABEL_120:
v30 = v54;
goto LABEL_39;
}
}
LABEL_28:
v22 = (unsigned int)Index;
HIDWORD(v54) = Index;
if( a7 )
{
started = CmpSnapshotKcbStackSecurity((__int64)v64, (__int64)v15, 859917635i64, &SecurityDescriptor);
if( started < 0 )
goto LABEL_120;
v22 = HIDWORD(v54);
if( HIDWORD(v54) == -1 )
{
v58 = AuditSetRegValueNew;
}
else
{
v44 = (*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(v9 + 32) + 8i64))(
*(_QWORD *)(v9 + 32),
HIDWORD(v54),
&v62);
IsValueTombstone = CmpIsValueTombstone(*(_QWORD *)(v9 + 32), v44);
v58 = IsValueTombstone == 0;
(*(void(__fastcall **)(__int64, __int64 *))(v46 + 16))(v46, &v62);
if( !IsValueTombstone )
{
started = CmpGetValueForAudit(*(_QWORD *)(v9 + 32), HIDWORD(v54), (__int64)v74, 0x34414D43u);
if( started < 0 )
goto LABEL_120;
}
v22 = HIDWORD(v54);
}
}
v23 = *(_QWORD *)(v9 + 32);
v24 = *(_DWORD *)(v9 + 40) >> 31;
v60 = v24;
if( !v15 )
{
if( (_DWORD)v22 == -1 )
{
LODWORD(AuditOperationType) = v24;
LODWORD(ValueChangeInfo) = Size;
LODWORD(Objecta) = v57;
started = CmpSetValueKeyNew(
v23,
(INT64)v20,
ValueName,
HIDWORD(Index),
(INT64)Objecta,
Src,
(UINT64)ValueChangeInfo,
AuditOperationType);
}
else
{
v34 = (*(__int64(__fastcall **)(UINT64, __int64, __int64 *))(v23 + 8))(v23, v22, &v62);
started = CmpSetValueKeyExisting(*(_QWORD *)(v9 + 32), (void *)HIDWORD(v54), v34, v57, Src, Size, v24);
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v9 + 32) + 16i64))(*(_QWORD *)(v9 + 32), &v62);
}
if( started < 0 )
goto LABEL_120;
v25 = ValueName;
Length = ValueName->Length;
if( v20->MaxValueNameLen < Length )
{
v20->MaxValueNameLen = Length;
*(_WORD *)(v9 + 178) = v25->Length;
}
v27 = Size;
if( v20->MaxValueDataLen < Size )
{
v20->MaxValueDataLen = Size;
*(_DWORD *)(v9 + 180) = v27;
}
v20->LastWriteTime = v12;
*(_LARGE_INTEGER *)(v9 + 168) = v12;
CmpCleanUpKcbCachedSymlink(v9, (INT64)a2);
Count = v20->ValueList.Count;
*(_DWORD *)(v9 + 100) = v20->ValueList.List;
v29 = *(_QWORD *)(v9 + 32);
*(_DWORD *)(v9 + 96) = Count;
HvUnlockHiveFlusherShared(v29);
goto LABEL_38;
}
LODWORD(HandleId) = 1;
LODWORD(Objecta) = Size;
LODWORD(v54) = CmpAddValueKeyNew(v23, ValueName, v57, Src, (UINT64)Objecta, (UINT64)HandleId);
v30 = v54;
if( (_DWORD)v54 == -1 )
{
started = -1073741670;
}
else
{
v35 = HIDWORD(v54);
v36 = *(_HHIVE **)(v9 + 32);
if( HIDWORD(v54) == -1 )
{
LODWORD(Index) = *(_DWORD *)(v9 + 280);
started = CmpAddValueToList(
(UINT64)v36,
(unsigned int)v54,
(unsigned int)Index,
1ui64,
(UINT64 *)(v9 + 280));
if( started < 0 )
goto LABEL_120;
v24 = v60;
v37 = Index;
}
else
{
v37 = HIDWORD(Index);
CmpSwapValueInList(v36, (unsigned int)v54, HIDWORD(Index), (_CHILD_LIST *)(v9 + 280));
}
HvUnlockHiveFlusherShared(*(_QWORD *)(v9 + 32));
v38 = (CM_KCB_UOW *)BugCheckParameter4;
if( v35 == -1 )
{
v39 = 4;
}
else
{
*((_DWORD *)BugCheckParameter4 + 22) = v35;
v39 = 5;
}
v38->ActionType = v39;
v38->NewValueCell = v54;
v38->StorageType = v24;
started = CmAddLogForAction(v38);
if( started < 0 )
{
if( v20 )
{
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v9 + 32) + 16i64))(*(_QWORD *)(v9 + 32), &v66);
v20 = 0i64;
}
HvLockHiveFlusherShared(*(_QWORD *)(v9 + 32));
v47 = *(_HHIVE **)(v9 + 32);
if( v35 == -1 )
CmpRemoveValueFromList(v47, v37, (unsigned int *)(v9 + 280));
else
CmpSwapValueInList(v47, v35, v37, (_CHILD_LIST *)(v9 + 280));
HvUnlockHiveFlusherShared(*(_QWORD *)(v9 + 32));
v19 = 0;
goto LABEL_120;
}
LABEL_38:
BugCheckParameter4 = 0i64;
ValueListDuplicated[0] = 0;
v30 = -1;
CmpReportNotifyForKcbStack((INT64)v64, (INT64)v15, 4i64, &DeferredPostAsync);
started = 0;
v19 = 0;
}
LABEL_39:
if( v20 )
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v9 + 32) + 16i64))(*(_QWORD *)(v9 + 32), &v66);
v14 = 1;
if( v30 != -1 )
CmpFreeValue(*(_QWORD *)(v9 + 32), v30);
goto LABEL_43;
}
CmpUnlockKcbStack((INT64)v64);
CmpLockKcbStackTopExclusiveRestShared((INT64)v64);
goto LABEL_10;
}
CmpUnlockKcbStack((INT64)v64);
CmpLockKcbStackTopExclusiveRestShared((INT64)v64);
}
}
started = CmpSnapshotTxOwnerArray(v16, (UINT64 *)((char *)&v54 + 4), &v68);
if( started < 0 )
goto LABEL_123;
CmpLogTransactionAborted(v9, 1, v42, HIDWORD(v54));
CmpUnlockKcbStack((INT64)v64);
v14 = 0;
CmpCleanupKcbStack((INT64)v64);
*(_OWORD *)v64 = 0i64;
WORD1(v64[0]) = -1;
v65 = 0i64;
CmpUnlockRegistry();
started = CmpRollbackTransactionArray(HIDWORD(v54), (PADAPTER_OBJECT *)v68, v43, &v60);
if( started < 0 )
{
v19 = 0;
v31 = 0;
goto LABEL_44;
}
}
started = -1073741790;
LABEL_133:
v31 = 1;
v14 = 0;
v19 = 0;
LABEL_45:
if( BugCheckParameter4 )
{
CmpRundownUnitOfWork(BugCheckParameter4);
CmpFreeUnitOfWork(BugCheckParameter4);
}
LABEL_47:
if( ValueListDuplicated[0] )
{
v48 = *(_DWORD *)(v9 + 284);
if( v48 != -1 )
HvFreeCell(*(_QWORD *)(v9 + 32), v48);
*(_DWORD *)(v9 + 284) = -1;
*(_DWORD *)(v9 + 280) = 0;
*(_QWORD *)(v9 + 288) = 0i64;
}
if( v19 )
HvUnlockHiveFlusherShared(*(_QWORD *)(v9 + 32));
if( v14 )
CmpUnlockKcbStack((INT64)v64);
CmpDrainDelayDerefContext((UINT64 **)a2);
if( v31 )
CmpUnlockRegistry();
if( DeferredPostAsync.Flink != &DeferredPostAsync )
CmpSignalDeferredPosts(&DeferredPostAsync);
CmpDetachFromRegistryProcess(&ApcState);
v32 = SecurityDescriptor;
if( started >= 0 && v11 && SecurityDescriptor )
{
*(_QWORD *)&v75 = __PAIR64__(Size, v57);
*((_QWORD *)&v75 + 1) = Src;
SeAdtRegistryValueChangedAuditAlarm(0i64, SecurityDescriptor, 0i64, ValueName, Object, v72, v74, v58);
}
if( *(_QWORD *)&v74[2] )
CmpFreeTransientPoolWithTag(*(VOID **)&v74[2], 0x34414D43ui64);
if( v32 )
CmpFreeTransientPoolWithTag(v32, 0x33414D43ui64);
CmpCleanupKcbStack((INT64)v64);
return(unsigned int)started;
}Referenced by:
NtSetValueKey