NtFlushKey

NTSTATUS __stdcall NtFlushKey(VOID *KeyHandle){
  _DMA_OPERATIONS *DmaOperations; 
  char v3; 
  _ETHREAD *CurrentThread; 
  UINT8 v5; 
  INT8 v6; 
  PVOID *v7; 
  _ETHREAD *v8; 
  UINT8 v9; 
  INT64 v10; 
  NTSTATUS v11; 
  INT64 v12; 
  _ETHREAD *v13; 
  PADAPTER_OBJECT v14; 
  int v15; 
  _DMA_OPERATIONS *v16; 
  _CM_KEY_CONTROL_BLOCK *v17; 
  CMHIVE *KeyHive; 
  _EX_RUNDOWN_REF *p_HiveRundown; 
  PADAPTER_OBJECT v20; 
  PADAPTER_OBJECT DmaAdapter; 
  INT64 a6[2]; 
  _SLIST_ENTRY *Argument[2]; 
  __int128 v25; 
  _KAPC_STATE ApcState; 
  _LARGE_INTEGER TimeStamp[2]; 
  __int128 v28; 

  DmaOperations = 0i64;
  *(_OWORD *)Argument = 0i64;
  v25 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
  v28 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
  DmaAdapter = 0i64;
  a6[1] = (INT64)a6;
  v3 = 0;
  a6[0] = (INT64)a6;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v5 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  v8 = (_ETHREAD *)KeGetCurrentThread();
  v9 = v5;
  if( !v5 )
  {
    KeLeaveCriticalRegionThread(&v8->Tcb);
    v11 = -1073741431;
    goto LABEL_21;
  }
  LOBYTE(v7) = v8->Tcb.PreviousMode;
  v11 = CmObReferenceObjectByHandle(KeyHandle, 0i64, v6, v7, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
  if( v11 >= 0 )
  {
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
      DmaOperations = DmaAdapter->AdapterObject.DmaHeader.DmaOperations;
    v13 = (_ETHREAD *)KeGetCurrentThread();
    --v13->Tcb.KernelApcDisable;
    v14 = DmaAdapter;
    if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v10, v12) )
    {
      Argument[0] = (_SLIST_ENTRY *)v14;
      v15 = CmpCallCallBacksEx(RegNtPreFlushKey, Argument, 0i64, 1, RegNtPostFlushKey, (INT64)v14, (INT64)a6);
      v11 = v15;
      if( v15 < 0 )
      {
        if( v15 == -1073740541 )
          v11 = 0;
        goto LABEL_18;
      }
      v3 = 1;
    }
    CmpLockRegistryFreezeAware(0);
    v16 = v14->AdapterObject.DmaHeader.DmaOperations;
    ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&v16->FreeAdapterChannel, 0i64);
    _InterlockedIncrement((volatile signed __int32 *)&v16->FreeMapRegisters);
    v11 = CmpPerformKeyBodyDeletionCheck((CM_KEY_BODY *)DmaAdapter, 0i64);
    if( v11 >= 0 )
    {
      v17 = (_CM_KEY_CONTROL_BLOCK *)v14->AdapterObject.DmaHeader.DmaOperations;
      KeyHive = (CMHIVE *)v17->KeyHash.KeyHive;
      if( KeyHive == *(CMHIVE **)&CmpMasterHive )
      {
        CmpUnlockKcb(v17);
        CmpUnlockRegistry();
        CmpAttachToRegistryProcess(&ApcState);
        CmpDoFlushAll(0i64);
        KiUnstackDetachProcess(&ApcState, 0i64);
        v11 = 0;
        goto LABEL_16;
      }
      p_HiveRundown = &KeyHive->HiveRundown;
      if( ExAcquireRundownProtection(&KeyHive->HiveRundown) )
      {
        CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)v14->AdapterObject.DmaHeader.DmaOperations);
        CmpUnlockRegistry();
        CmpAttachToRegistryProcess(&ApcState);
        v11 = CmpFlushHive(KeyHive, 0i64);
        if( v11 < 0 )
          v11 = -1073741491;
        KiUnstackDetachProcess(&ApcState, 0i64);
        ExReleaseRundownProtection(p_HiveRundown);
        goto LABEL_16;
      }
      v11 = -1073740763;
    }
    CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)v14->AdapterObject.DmaHeader.DmaOperations);
    CmpUnlockRegistry();
LABEL_16:
    if( v3 )
      v11 = CmPostCallbackNotificationEx(
              RegNtPostFlushKey,
              (_SLIST_ENTRY *)DmaAdapter,
              (unsigned int)v11,
              (INT64)Argument,
              0i64,
              (INT64)a6);
LABEL_18:
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  v20 = DmaAdapter;
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
LABEL_21:
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v20) = 21;
    (*(void(__fastcall **)(PADAPTER_OBJECT, _LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      v20,
      TimeStamp,
      (unsigned int)v11,
      0i64,
      DmaOperations,
      0i64);
  }
  if( v9 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return v11;
}

Referenced by: