NtRestoreKey

NTSTATUS __stdcall NtRestoreKey(VOID *KeyHandle, VOID *FileHandle, UINT64 Flags){
  char v3; 
  int v4; 
  char PreviousMode; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v9; 
  INT8 v10; 
  PVOID *v11; 
  NTSTATUS v12; 
  VOID *v13; 
  NTSTATUS v14; 
  INT64 v15; 
  _ADAPTER_OBJECT *v16; 
  _ETHREAD *v17; 
  _SLIST_ENTRY *v18; 
  _SLIST_ENTRY *v19; 
  int v20; 
  VOID *Handle; 
  PADAPTER_OBJECT DmaAdapter; 
  INT64 a6[2]; 
  _SLIST_ENTRY *Argument[2]; 
  __int128 v26; 
  __int128 v27; 
  _KAPC_STATE ApcState; 

  DmaAdapter = 0i64;
  Handle = 0i64;
  a6[1] = (INT64)a6;
  *(_OWORD *)Argument = 0i64;
  v3 = 0;
  a6[0] = (INT64)a6;
  v4 = Flags;
  v26 = 0i64;
  v27 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132) )
  {
    v9 = CmCheckNoTxContext();
    if( v9 < 0 )
    {
LABEL_27:
      ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      return v9;
    }
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, PreviousMode) )
    {
      v9 = -1073741727;
      goto LABEL_27;
    }
    if( PreviousMode == 1 )
    {
      v12 = IoConvertFileHandleToKernelHandle(FileHandle, 1, 1ui64, 0, &Handle);
      v13 = Handle;
      v9 = v12;
      if( v12 < 0 )
      {
LABEL_24:
        if( v13 && v13 != FileHandle )
          ZwClose((_HANDLE)v13);
        goto LABEL_27;
      }
    }
    else
    {
      v13 = FileHandle;
      Handle = FileHandle;
    }
    LOBYTE(v11) = PreviousMode;
    v14 = CmObReferenceObjectByHandle(KeyHandle, 0i64, v10, v11, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
    v16 = DmaAdapter;
    v9 = v14;
    if( v14 < 0 )
    {
LABEL_22:
      if( v16 )
        HalPutDmaAdapter(v16);
      goto LABEL_24;
    }
    if( (LODWORD(DmaAdapter->AdapterObject.DmaHeader.DmaOperations->PutDmaAdapter) & 0x80u) != 0 )
    {
      v9 = -1073741790;
      goto LABEL_22;
    }
    v17 = (_ETHREAD *)KeGetCurrentThread();
    --v17->Tcb.KernelApcDisable;
    v18 = (_SLIST_ENTRY *)DmaAdapter;
    v19 = (_SLIST_ENTRY *)Handle;
    if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, (INT64)v16, v15) )
    {
      Argument[0] = v18;
      Argument[1] = v19;
      LODWORD(v26) = v4;
      v20 = CmpCallCallBacksEx(RegNtPreRestoreKey, Argument, 0i64, 1, RegNtPostRestoreKey, 0i64, (INT64)a6);
      v9 = v20;
      if( v20 < 0 )
      {
        if( v20 == -1073740541 )
          v9 = 0;
LABEL_21:
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        v16 = DmaAdapter;
        v13 = Handle;
        goto LABEL_22;
      }
      v3 = 1;
    }
    CmpAttachToRegistryProcess(&ApcState);
    v9 = CmRestoreKey(v18, (__int64)v19, v4, PreviousMode);
    KiUnstackDetachProcess(&ApcState, 0i64);
    if( v3 )
      v9 = CmPostCallbackNotificationEx(RegNtPostRestoreKey, v18, (unsigned int)v9, (INT64)Argument, 0i64, (INT64)a6);
    goto LABEL_21;
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return -1073741431;
}

Referenced by: