NtCreateRegistryTransaction

NTSTATUS __stdcall NtCreateRegistryTransaction(
        PVOID *TransactionHandle,
        UINT64 DesiredAccess,
        OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 CreateOptions){
  int v4; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  bool v9; 
  char v10; 
  __int64 v11; 
  NTSTATUS Object; 
  _QWORD *v13; 
  __int64 v15; 
  __int64 v16; 
  HANDLE Handle; 
  void *DmaAdapter[2]; 
  v4 = CreateOptions;
  v6 = DesiredAccess;
  DmaAdapter[0] = 0i64;
  Handle = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  if( !v9 )
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v9 )
  {
    if( v4 )
    {
      Object = -1073741811;
    }
    else
    {
      v10 = *((_BYTE *)KeGetCurrentThread() + 562);
      if( v10 == 1 )
      {
        v11 = 0x7FFFFFFF0000i64;
        if( (unsigned __int64)TransactionHandle < 0x7FFFFFFF0000i64 )
          v11 = (__int64)TransactionHandle;
        *(_QWORD *)v11 = 0i64;
      }
      else
      {
        *TransactionHandle = 0i64;
      }
      Object = ObCreateObjectEx(
                 v10,
                 CmRegistryTransactionType,
                 (__int64)ObjectAttributes,
                 v10,
                 v15,
                 24,
                 0,
                 0,
                 DmaAdapter,
                 0i64);
      if( Object >= 0 )
      {
        v13 = DmaAdapter[0];
        *(_OWORD *)DmaAdapter[0] = 0i64;
        v13[2] = 0i64;
        v13[1] = 0i64;
        LODWORD(v16) = 0;
        Object = ObInsertObjectEx(v13, 0i64, v6, 0i64, v16, 0i64, &Handle);
        DmaAdapter[0] = 0i64;
        if( Object >= 0 )
        {
          *TransactionHandle = Handle;
          Handle = 0i64;
          Object = 0;
        }
      }
    }
  }
  else
  {
    Object = -1073741431;
  }
  if( Handle )
    NtClose(Handle);
  if( DmaAdapter[0] )
    HalPutDmaAdapter((PADAPTER_OBJECT)DmaAdapter[0]);
  if( v9 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  return Object;
}

Referenced by: