CcRegistryChangeCallback

NTSTATUS __stdcall CcRegistryChangeCallback(PVOID P){
  char *v1; 
  char *v2; 
  volatile unsigned __int64 TickCountQuad; 
  unsigned __int64 v4; 
  NTSTATUS result; 
  __int64 v6; 
  INT64 v7; 
  __int64 v8; 
  NTSTATUS v9; 
  _IO_STATUS_BLOCK IoStatusBlock; 

  v1 = (char *)P + 56;
  IoStatusBlock = 0i64;
  v2 = (char *)P;
  TickCountQuad = KUSER_SHARED_DATA.TickCountQuad;
  v4 = KUSER_SHARED_DATA.TickCountQuad - *((_QWORD *)P + 6);
  result = DbgPrintEx(
             0x7Fu,
             2u,
             "CcRegistryChangeCallback: Something of interest changed(callback:%c), under:\"%wZ\"\n",
             *((_BYTE *)P + 72) != 0 ? 70 : 84,
             (char *)P + 56);
  if( !v2[72] )
  {
    (*((void(__fastcall **)(char *))v2 + 5))(v2);
    *((_QWORD *)v2 + 6) = TickCountQuad;
    result = DbgPrintEx(0x7Fu, 2u, "CcRegistryChangeCallback: Processed \"%wZ\", TickDiff=%I64d\n", v1, v4);
  }
  v2[72] = 0;
  if( !*((_QWORD *)v2 + 4) )
  {
    result = CcOpenRegistryPath((INT64)v1, (VOID **)v2 + 4, v6, v7);
    if( result < 0 )
    {
      DbgPrintEx(
        0x7Fu,
        0,
        "CcRegistryChangeCallback: Failed to open Key, status=0x%08x \"%wZ\n",
        (unsigned int)result,
        v1);
      result = (unsigned int)ExFreePoolWithTag(v2, 0x52576343u);
      v2 = 0i64;
    }
  }
  if( v2 )
  {
    v8 = *((_QWORD *)v2 + 4);
    if( v8 )
    {
      v9 = ZwNotifyChangeKey(v8, 0, (PIO_APC_ROUTINE)v2, (PVOID)1, &IoStatusBlock, 5u, 1u, 0i64, 0, 1u);
      if( v9 == 259 )
      {
        result = DbgPrintEx(0x7Fu, 2u, "CcRegistryChangeCallback: Watch queued \"%wZ\"\n", v2 + 56);
      }
      else if( v9 >= 0 )
      {
        result = DbgPrintEx(
                   0x7Fu,
                   2u,
                   "CcRegistryChangeCallback: Watch queued \"%wZ\" (for Immediate Processing)\n",
                   v2 + 56);
      }
      else
      {
        ZwClose(*((_QWORD *)v2 + 4));
        *((_QWORD *)v2 + 4) = 0i64;
        v2[72] = 1;
        result = DbgPrintEx(
                   0x7Fu,
                   0,
                   "CcRegistryChangeCallback: Failed Watch request, status=0x%08x \"%wZ\"\n",
                   (unsigned int)v9,
                   v2 + 56);
      }
    }
  }
  if( !dword_140C507F8 && v2 && !v2[72] )
    dword_140C507F8 = 1;
  return result;
}

Referenced by: