NtSaveMergedKeys

NTSTATUS __stdcall NtSaveMergedKeys(PVOID HighPrecedenceKeyHandle, PVOID LowPrecedenceKeyHandle, PVOID FileHandle){
  _ETHREAD *CurrentThread; 
  NTSTATUS v7; 
  CHAR v8; 
  _OBJECT_TYPE *v9; 
  INT8 v10; 
  _OBJECT_TYPE *v11; 
  INT8 v12; 
  PADAPTER_OBJECT DmaAdapter; 
  PADAPTER_OBJECT v15; 
  HANDLE FileHandlea; 
  HANDLE LowPrecedenceKeyHandlea; 
  HANDLE HighPrecedenceKeyHandlea; 
  KAPC_STATE ApcState; 
  LowPrecedenceKeyHandlea = 0i64;
  HighPrecedenceKeyHandlea = 0i64;
  v15 = 0i64;
  DmaAdapter = 0i64;
  FileHandlea = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown) )
  {
    v7 = CmCheckNoTxContext();
    if( v7 >= 0 )
    {
      v8 = *((_BYTE *)KeGetCurrentThread() + 562);
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, v8) )
      {
        if( v8 )
        {
          v7 = CmConvertHandleToKernelHandle(HighPrecedenceKeyHandle, v9, v8, 0i64, &HighPrecedenceKeyHandlea);
          if( v7 >= 0 )
          {
            v7 = CmConvertHandleToKernelHandle(LowPrecedenceKeyHandle, v11, v8, 0i64, &LowPrecedenceKeyHandlea);
            if( v7 >= 0 )
            {
              v7 = IoConvertFileHandleToKernelHandle(FileHandle, v8, 2ui64, 0, &FileHandlea);
              if( v7 >= 0 )
                v7 = ZwSaveMergedKeys(HighPrecedenceKeyHandlea, LowPrecedenceKeyHandlea, FileHandlea);
            }
          }
        }
        else
        {
          v7 = CmObReferenceObjectByHandle(HighPrecedenceKeyHandle, 0i64, v10, 0i64, (OBJECT_HANDLE_INFORMATION *)&v15);
          if( v7 >= 0 )
          {
            v7 = CmObReferenceObjectByHandle(
                   LowPrecedenceKeyHandle,
                   0i64,
                   v12,
                   0i64,
                   (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
            if( v7 >= 0 )
            {
              CmpAttachToRegistryProcess(&ApcState);
              v7 = CmSaveMergedKeys((_CM_KEY_BODY *)v15, (_CM_KEY_BODY *)DmaAdapter, FileHandle);
              KiUnstackDetachProcess(&ApcState, 0i64);
            }
          }
        }
      }
      else
      {
        v7 = -1073741727;
      }
    }
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( DmaAdapter )
      HalPutDmaAdapter(DmaAdapter);
    if( v15 )
      HalPutDmaAdapter(v15);
    if( FileHandlea )
      ZwClose(FileHandlea);
  }
  else
  {
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    v7 = -1073741431;
  }
  if( LowPrecedenceKeyHandlea )
    ZwClose(LowPrecedenceKeyHandlea);
  if( HighPrecedenceKeyHandlea )
    ZwClose(HighPrecedenceKeyHandlea);
  return v7;
}

Referenced by: