NtCreateKeyTransacted

NTSTATUS __stdcall NtCreateKeyTransacted(
        VOID **KeyHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 TitleIndex,
        _UNICODE_STRING *Class,
        UINT64 CreateOptions,
        VOID *TransactionHandle,
        UINT64 *Disposition){
  _ETHREAD *CurrentThread; 
  int v10; 
  UINT8 v12; 
  char PreviousMode; 
  NTSTATUS v14; 
  __int64 v15; 
  __int64 v16; 
  NTSTATUS Key; 
  NTSTATUS v19; 
  PVOID Object; 
  PVOID v21; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v10 = DesiredAccess;
  --CurrentThread->Tcb.KernelApcDisable;
  v12 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  if( !v12 )
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( !v12 )
    return -1073741431;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  Object = 0i64;
  v14 = ObReferenceObjectByHandle(TransactionHandle, 4ui64, *(&CmpDummyThreadEvent + 6), PreviousMode, &Object, 0i64);
  v16 = (__int64)Object;
  Key = v14;
  if( v14 == -1073741788 )
  {
    v21 = 0i64;
    v19 = ObReferenceObjectByHandle(
            TransactionHandle,
            4ui64,
            (_OBJECT_TYPE *)TmTransactionObjectType,
            KeGetCurrentThread()->PreviousMode,
            &v21,
            0i64);
    v16 = (__int64)v21;
    Key = v19;
LABEL_7:
    if( Key >= 0 )
      Key = CmCreateKey(KeyHandle, v10, ObjectAttributes, v15, (__int128 *)Class, CreateOptions, Disposition, v16);
    goto LABEL_9;
  }
  if( v14 >= 0 )
  {
    v16 = (unsigned __int64)Object | 1;
    goto LABEL_7;
  }
LABEL_9:
  if( v16 )
    CmpTransDereferenceTransaction(v16);
  ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return Key;
}

Referenced by: