CmAddLogForAction
__int64 __fastcall CmAddLogForAction(__int64 a1, ULONG a2){
unsigned int v2;
UINT8 *v4;
ULONG v5;
__int64 v6;
unsigned int v7;
unsigned int v8;
int v9;
_CM_KEY_CONTROL_BLOCK *v10;
_UNICODE_STRING *v11;
int v12;
int v13;
bool v14;
__int64 v15;
__int64(__fastcall *v16)(__int64, _QWORD, int *);
__int64 v17;
ULONG v18;
unsigned __int16 v19;
unsigned int v20;
unsigned int Length;
unsigned int v22;
UINT8 *PoolWithTag;
int v24;
int v25;
INT64 v26;
WCHAR *v27;
UINT64 v28;
UINT8 *v29;
UINT8 *v30;
BOOLEAN v31;
PLOG_FILE_OBJECT *v32;
NTSTATUS v33;
CLFS_INFORMATION *v34;
CLFS_INFORMATION *v35;
int v37;
UINT8 *v38;
__int64 v39;
UINT64 v40;
unsigned int v41;
__int64 v42;
unsigned __int16 v43;
__int64 v44;
WCHAR *v45;
int v46[2];
void *Src;
_UNICODE_STRING *KeyPath;
__int64 v49;
int v50[2];
__int64 v51;
void *CmRm[10];
unsigned int v53;
ULONG pcbInfoBuffer;
size_t Size;
INT64 v56;
pcbInfoBuffer = a2;
v2 = 0;
v46[1] = 0;
v50[1] = 0;
v46[0] = -1;
v4 = 0i64;
v50[0] = -1;
v5 = 0;
v6 = *(_QWORD *)(a1 + 56);
v7 = 0;
v51 = 0i64;
v8 = 0;
v56 = 0i64;
v53 = -1;
v9 = *(_DWORD *)(v6 + 48);
pcbInfoBuffer = 0;
LODWORD(Size) = 0;
v49 = 0i64;
if( (v9 & 0x80u) != 0 )
return 0i64;
v10 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 48);
CmRm[0] = v10->KeyHash.KeyHive[2].Storage[1].FreeDisplay[7].Display.Buffer;
if( !*((_QWORD *)CmRm[0] + 12) || !*(_QWORD *)(v6 + 56) || *(_DWORD *)(a1 + 68) == 13 )
return 0i64;
KeyPath = 0i64;
CmpConstructNameWithStatus(v10, &KeyPath);
v11 = KeyPath;
if( KeyPath )
{
v12 = *(_DWORD *)(a1 + 68);
if( !v12 || v12 == 2 )
{
v37 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)(a1 + 48) + 88i64) + 24i64);
}
else
{
if( v12 <= 3 )
goto LABEL_20;
if( v12 <= 6 )
{
v13 = 80;
v14 = (unsigned int)(v12 - 4) <= 1;
v15 = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64);
v16 = *(__int64(__fastcall **)(__int64, _QWORD, int *))(v15 + 8);
if( v14 )
{
v53 = *(_DWORD *)(a1 + 92);
v17 = v16(v15, v53, v46);
v56 = v17;
if( v17 )
{
v18 = *(_DWORD *)(v17 + 4);
pcbInfoBuffer = v18;
if( v18 >= 0x80000000 )
{
v18 += 0x80000000;
pcbInfoBuffer = v18;
}
v13 = v18 + 80;
LODWORD(Size) = v18;
if( v18 >= 0xFFFFFFB0 )
{
v33 = -1073741675;
LABEL_42:
if( v17 )
(*(void(__fastcall **)(_QWORD, int *))(*(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64) + 16i64))(
*(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64),
v46);
if( v4 )
ExFreePoolWithTag(v4, 0);
goto LABEL_46;
}
goto LABEL_15;
}
}
else
{
v53 = *(_DWORD *)(a1 + 88);
v17 = v16(v15, v53, v46);
v56 = v17;
if( v17 )
{
LABEL_15:
v19 = *(_WORD *)(v17 + 2);
if( (*(_BYTE *)(v17 + 16) & 1) != 0 )
v19 *= 2;
v7 = v19;
v20 = v13;
v2 = v19 + v13;
goto LABEL_18;
}
}
LABEL_69:
v33 = -1073741670;
LABEL_46:
CmpFreeTransientPoolWithTag(v11, 0x624E4D43ui64);
return(unsigned int)v33;
}
if( v12 != 9 )
{
if( v12 == 7 || v12 == 8 )
{
v2 = 56;
goto LABEL_20;
}
if( v12 != 11 )
{
LABEL_20:
Length = v11->Length;
v22 = Length + v2;
if( v22 >= Length )
{
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v22, 0x20204D43ui64);
v4 = PoolWithTag;
if( !PoolWithTag )
{
LABEL_74:
v33 = -1073741670;
goto LABEL_39;
}
*((_DWORD *)PoolWithTag + 1) = v22;
*((_DWORD *)PoolWithTag + 2) = 1;
*((_OWORD *)PoolWithTag + 1) = *(_OWORD *)(*(_QWORD *)(a1 + 56) + 88i64);
*((_WORD *)PoolWithTag + 16) = v11->Length;
*((_WORD *)PoolWithTag + 17) = v11->MaximumLength;
v24 = *(_DWORD *)(a1 + 68);
if( !v24 || v24 == 2 )
{
*((_DWORD *)PoolWithTag + 3) = (v24 != 0) + 1;
*((_DWORD *)PoolWithTag + 12) = *(_DWORD *)(a1 + 72);
*((_QWORD *)PoolWithTag + 5) = PoolWithTag + 64;
memmove(PoolWithTag + 64, (UINT8 *)v11->Buffer, v11->Length);
v38 = &v4[v11->Length + 64];
*((_QWORD *)v4 + 7) = v38;
v39 = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 88i64);
v40 = *(unsigned int *)(v39 + 24);
}
else
{
if( v24 <= 3 )
goto LABEL_34;
if( v24 <= 6 )
{
Src = 0i64;
v25 = 0;
KeyPath = (_UNICODE_STRING *)0xFFFFFFFFi64;
LOBYTE(pcbInfoBuffer) = 0;
if( v24 == 4 )
{
*((_DWORD *)v4 + 3) = 3;
}
else
{
LOBYTE(v25) = v24 != 5;
*((_DWORD *)v4 + 3) = v25 + 4;
}
v26 = v56;
*((_DWORD *)v4 + 16) = *(_DWORD *)(v56 + 12);
*((_QWORD *)v4 + 5) = v4 + 80;
memmove(v4 + 80, (UINT8 *)v11->Buffer, v11->Length);
v27 = (WCHAR *)&v4[v11->Length + 80];
*((_QWORD *)v4 + 7) = v27;
if( (*(_BYTE *)(v26 + 16) & 1) != 0 )
CmpCopyCompressedName(v27, v7, (PWCHAR)(v26 + 20), *(unsigned __int16 *)(v26 + 2));
else
memmove((UINT8 *)v27, (UINT8 *)(v26 + 20), v7);
*((_WORD *)v4 + 25) = v7;
*((_WORD *)v4 + 24) = v7;
if( *(_DWORD *)(a1 + 68) != 6 )
{
*((_DWORD *)v4 + 17) = v5;
if( CmpGetValueData(
*(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64),
v53,
v26,
&Size,
(INT64)&Src,
(INT64)&pcbInfoBuffer,
(INT64)&KeyPath) )
{
v28 = (unsigned int)Size;
v29 = (UINT8 *)Src;
v30 = (UINT8 *)v27 + v7;
*((_QWORD *)v4 + 9) = v30;
memmove(v30, v29, v28);
if( (_BYTE)pcbInfoBuffer == 1 )
ExFreePoolWithTag(Src, 0);
else(*(void(__fastcall **)(_QWORD, _UNICODE_STRING **))(*(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64)
+ 16i64))(
*(_QWORD *)(*(_QWORD *)(a1 + 48) + 32i64),
&KeyPath);
goto LABEL_34;
}
goto LABEL_74;
}
*((_DWORD *)v4 + 17) = 0;
*((_QWORD *)v4 + 9) = 0i64;
LABEL_34:
*(_DWORD *)v4 = HvBufferCheckSum(v4, *((unsigned int *)v4 + 1));
v31 = ClfsLsnInvalid((const CLFS_LSN *)(*(_QWORD *)(a1 + 56) + 104i64));
v32 = (PLOG_FILE_OBJECT *)CmRm[0];
v33 = CmpTransWriteLog(
(_CM_RM *)CmRm[0],
v4,
*((unsigned int *)v4 + 1),
v31 != 0 ? 2 : 0,
(_CLS_LSN *)&v51);
if( v33 >= 0 && ClfsLsnInvalid((const CLFS_LSN *)(*(_QWORD *)(a1 + 56) + 104i64)) )
*(_QWORD *)(*(_QWORD *)(a1 + 56) + 104i64) = v51;
pcbInfoBuffer = 120;
v34 = (CLFS_INFORMATION *)ExAllocatePoolWithTag(PagedPool, 0x78ui64, 0x20204D43ui64);
v35 = v34;
if( v34 )
{
ClfsGetLogFileInformation(v32[11], v34, &pcbInfoBuffer);
ExFreePoolWithTag(v35, 0);
}
goto LABEL_39;
}
if( v24 != 9 )
{
switch( v24 )
{
case 7:
*((_DWORD *)PoolWithTag + 3) = 6;
*((_QWORD *)PoolWithTag + 5) = PoolWithTag + 56;
memmove(PoolWithTag + 56, (UINT8 *)v11->Buffer, v11->Length);
*((_DWORD *)v4 + 12) = *(_DWORD *)(a1 + 88);
break;
case 8:
*((_DWORD *)PoolWithTag + 3) = 7;
*((_QWORD *)PoolWithTag + 5) = PoolWithTag + 56;
memmove(PoolWithTag + 56, (UINT8 *)v11->Buffer, v11->Length);
*((_QWORD *)v4 + 6) = *(_QWORD *)(a1 + 88);
break;
case 11:
*((_DWORD *)PoolWithTag + 3) = 9;
*((_QWORD *)PoolWithTag + 5) = PoolWithTag + 64;
memmove(PoolWithTag + 64, (UINT8 *)v11->Buffer, v11->Length);
v44 = v49;
v45 = (WCHAR *)&v4[v11->Length + 64];
*((_QWORD *)v4 + 7) = v45;
if( (*(_BYTE *)(v44 + 2) & 0x20) != 0 )
CmpCopyCompressedName(v45, v8, (PWCHAR)(v44 + 76), *(unsigned __int16 *)(v44 + 72));
else
memmove((UINT8 *)v45, (UINT8 *)(v44 + 76), v8);
*((_WORD *)v4 + 25) = v8;
*((_WORD *)v4 + 24) = v8;
break;
}
goto LABEL_34;
}
*((_DWORD *)PoolWithTag + 3) = 8;
*((_QWORD *)PoolWithTag + 5) = PoolWithTag + 64;
memmove(PoolWithTag + 64, (UINT8 *)v11->Buffer, v11->Length);
v41 = *(_DWORD *)(*(_QWORD *)(a1 + 88) + 24i64);
*((_DWORD *)v4 + 12) = v41;
v40 = v41;
v38 = &v4[v11->Length + 64];
*((_QWORD *)v4 + 7) = v38;
v39 = *(_QWORD *)(a1 + 88);
}
memmove(v38, (UINT8 *)(v39 + 32), v40);
goto LABEL_34;
}
v33 = -1073741562;
LABEL_39:
if( v49 )
(*(void(__fastcall **)(_QWORD, int *))(*(_QWORD *)(*(_QWORD *)(a1 + 88) + 32i64) + 16i64))(
*(_QWORD *)(*(_QWORD *)(a1 + 88) + 32i64),
v50);
v17 = v56;
goto LABEL_42;
}
v20 = 64;
v42 = (*(__int64(__fastcall **)(_QWORD, _QWORD, int *))(*(_QWORD *)(*(_QWORD *)(a1 + 88) + 32i64) + 8i64))(
*(_QWORD *)(*(_QWORD *)(a1 + 88) + 32i64),
*(unsigned int *)(*(_QWORD *)(a1 + 88) + 40i64),
v50);
v49 = v42;
if( v42 )
{
v43 = *(_WORD *)(v42 + 72);
if( (*(_BYTE *)(v42 + 2) & 0x20) != 0 )
v43 *= 2;
v8 = v43;
v2 = v43 + 64;
goto LABEL_18;
}
goto LABEL_69;
}
v37 = *(_DWORD *)(*(_QWORD *)(a1 + 88) + 24i64);
}
v20 = 64;
v2 = v37 + 64;
LABEL_18:
if( v2 < v20 )
{
v33 = -1073741675;
goto LABEL_39;
}
v5 = pcbInfoBuffer;
goto LABEL_20;
}
return 3221225626i64;
}Referenced by:
CmDeleteValueKey
CmRenameKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpCreateChild
CmpSetSecurityDescriptorInfo