NtQueryKey

NTSTATUS __stdcall NtQueryKey(
        VOID *KeyHandle,
        KEY_INFORMATION_CLASS KeyInformationClass,
        VOID *KeyInformation,
        UINT64 Length,
        UINT64 *ResultLength){
  __int64 v5; 
  _ETHREAD *CurrentThread; 
  KPROCESSOR_MODE v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  __int64 v14; 
  BOOL v15; 
  NTSTATUS Key; 
  _QWORD *v17; 
  _ETHREAD *v18; 
  ULONG IsResourceAcquiredSharedLite; 
  unsigned __int16 *v20; 
  int v21; 
  _ETHREAD *v22; 
  bool v23; 
  void *v24; 
  unsigned int v26; 
  unsigned int v27; 
  KPROCESSOR_MODE v28; 
  PVOID *Object; 
  NTSTATUS v30; 
  char v31; 
  char v32; 
  char v33; 
  bool v34; 
  size_t Size; 
  PVOID v36; 
  PADAPTER_OBJECT DmaAdapter; 
  PADAPTER_OBJECT v38; 
  __int64 v39; 
  INT64 v40[2]; 
  PVOID v41; 
  struct _OBJECT_HANDLE_INFORMATION HandleInformation; 
  SLIST_ENTRY *Argument; 
  NTSTATUS v44; 
  int v45; 
  INT64 *v46; 
  NTSTATUS v47; 
  __int128 v48; 
  __int64 v49; 
  int v50; 
  INT64 v51; 
  KEY_INFORMATION_CLASS v52; 
  VOID *v53; 
  int v54; 
  UINT64 *v55; 
  void *Src[2]; 
  char v57; 
  INT64 result[9]; 
  LARGE_INTEGER v59[2]; 
  __int128 v60; 
  v5 = (unsigned int)Length;
  Size = (unsigned int)Length;
  HandleInformation = 0i64;
  memset((INT64)result, 0i64);
  *(_OWORD *)&v59[0].LowPart = 0i64;
  v60 = 0i64;
  v39 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp(v59, 0x20000ui64);
  v32 = 0;
  v33 = 0;
  DmaAdapter = 0i64;
  memset((INT64)&v51, 0i64);
  *(_OWORD *)Src = 0i64;
  v57 = 0;
  v40[1] = (INT64)v40;
  v40[0] = (INT64)v40;
  v38 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v34 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  if( !v34 )
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( !v34 )
  {
    Key = -1073741431;
    goto LABEL_35;
  }
  if( (unsigned int)KeyInformationClass > MaxKeyInfoClass )
  {
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    {
      if( KeyHandle )
      {
        v28 = *((_BYTE *)KeGetCurrentThread() + 562);
        v41 = 0i64;
        if( ObReferenceObjectByHandle(KeyHandle, 0, (POBJECT_TYPE)CmKeyObjectType, v28, &v41, 0i64) >= 0 )
        {
          v39 = *((_QWORD *)v41 + 1);
          HalPutDmaAdapter((PADAPTER_OBJECT)v41);
        }
      }
    }
    Key = -1073741811;
    goto LABEL_35;
  }
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  v31 = v10;
  if( v10 == 1 )
  {
    if( (_DWORD)v5 )
    {
      v11 = (unsigned __int64)KeyInformation;
      if( ((unsigned __int8)KeyInformation & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v12 = (unsigned __int64)KeyInformation + v5 - 1;
      if( (unsigned __int64)KeyInformation > v12 || v12 >= 0x7FFFFFFF0000i64 )
        ExRaiseAccessViolation();
      v13 = (v12 & 0xFFFFFFFFFFFFF000ui64) + 4096;
      do
      {
        *(_BYTE *)v11 = *(_BYTE *)v11;
        v11 = (v11 & 0xFFFFFFFFFFFFF000ui64) + 4096;
      }
      while( v11 != v13 );
    }
    v14 = (__int64)ResultLength;
    if( (unsigned __int64)ResultLength >= 0x7FFFFFFF0000i64 )
      v14 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v14 = *(_DWORD *)v14;
    v10 = 1;
  }
  v15 = ((KeyInformationClass - 3) & 0xFFFFFFFB) != 0;
  v36 = 0i64;
  Key = ObReferenceObjectByHandle(KeyHandle, v15, (POBJECT_TYPE)CmKeyObjectType, v10, &v36, &HandleInformation);
  v17 = v36;
  DmaAdapter = (PADAPTER_OBJECT)v36;
  v30 = Key;
  if( Key < 0 )
    goto LABEL_36;
  if( *(_DWORD *)v36 != 1803104306 )
  {
    if( KeyInformationClass != KeyCachedInformation )
    {
      Key = -1073741816;
      goto LABEL_35;
    }
    *(_DWORD *)ResultLength = 40;
    if( (unsigned int)v5 < 0x28 )
    {
      Key = -1073741789;
      v30 = -1073741789;
      goto LABEL_36;
    }
    *(_OWORD *)KeyInformation = 0i64;
    *((_OWORD *)KeyInformation + 1) = 0i64;
    *((_QWORD *)KeyInformation + 4) = 0i64;
    *((_DWORD *)KeyInformation + 5) = *(_DWORD *)(v17[1] + 96i64);
    goto LABEL_34;
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    v39 = *((_QWORD *)v36 + 1);
  if( ((KeyInformationClass - 3) & 0xFFFFFFFB) == 0 && !HandleInformation.GrantedAccess )
  {
    Key = -1073741790;
    goto LABEL_35;
  }
  v18 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v18 + 242);
  v33 = 1;
  if( !CmpCallBackCount )
  {
    v20 = (unsigned __int16 *)v36;
    goto LABEL_30;
  }
  IsResourceAcquiredSharedLite = ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock);
  v20 = (unsigned __int16 *)v36;
  if( !IsResourceAcquiredSharedLite )
  {
    v51 = (INT64)v36;
    v52 = KeyInformationClass;
    v53 = KeyInformation;
    v54 = Size;
    v55 = ResultLength;
    v21 = CmpCallCallBacksEx(RegNtQueryKey, (SLIST_ENTRY **)&v51, 0i64, 1, RegNtPostQueryKey, (INT64)v36, (INT64)v40);
    Key = v21;
    v30 = v21;
    if( v21 >= 0 )
    {
      v32 = 1;
      goto LABEL_30;
    }
    if( v21 != -1073740541 )
      goto LABEL_36;
LABEL_34:
    Key = 0;
LABEL_35:
    v30 = Key;
    goto LABEL_36;
  }
LABEL_30:
  if( KeyInformationClass == KeyHandleTagsInformation )
  {
    *(_DWORD *)ResultLength = 4;
    if( (unsigned int)Size < 4 )
    {
      Key = -1073741789;
      v30 = -1073741789;
      goto LABEL_36;
    }
    *(_DWORD *)KeyInformation = v20[25];
    goto LABEL_34;
  }
  Key = CmKeyBodyRemapToVirtualForEnum((__int64 *)&DmaAdapter, v31, v15, (__int64 *)&v38);
  v30 = Key;
  if( Key >= 0 )
  {
    v26 = Size;
    Key = CmpBounceContextStart(
            (INT64)Src,
            (struct SLIST_ENTRY *)KeyInformation,
            (unsigned int)Size,
            (unsigned int)v31,
            2);
    v30 = Key;
    if( Key >= 0 )
    {
      LODWORD(Object) = Size;
      Key = CmQueryKey(
              (_CM_KEY_BODY *)DmaAdapter,
              (_CM_KEY_BODY *)v38,
              KeyInformationClass,
              Src[1],
              (UINT64)Object,
              (size_t *)((char *)&Size + 4));
      v30 = Key;
      if( Key >= 0 || Key == -2147483643 || Key == -1073741789 )
      {
        v27 = HIDWORD(Size);
        *(_DWORD *)ResultLength = HIDWORD(Size);
        if( Key != -1073741789 )
        {
          if( (unsigned int)Size >= v27 )
            v26 = v27;
          if( Src[0] != Src[1] )
            memmove((UINT8 *)Src[0], (UINT8 *)Src[1], v26);
        }
      }
    }
  }
LABEL_36:
  if( v38 )
    HalPutDmaAdapter(v38);
  if( v32 )
  {
    if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) && (INT64 *)v40[0] != v40 )
    {
      v45 = 0;
      v48 = 0i64;
      v49 = 0i64;
      v50 = 0;
      Argument = (SLIST_ENTRY *)DmaAdapter;
      v44 = Key;
      v47 = Key;
      v46 = &v51;
      CmpCallCallBacksEx(RegNtPostQueryKey, &Argument, 0i64, 0, RegNtPostQueryKey, (INT64)DmaAdapter, (INT64)v40);
      Key = v47;
    }
    v30 = Key;
  }
  if( v33 )
  {
    v22 = (_ETHREAD *)KeGetCurrentThread();
    v23 = (*((_WORD *)v22 + 242))++ == 0xFFFF;
    if( v23 && *((_ETHREAD **)v22 + 19) != (_ETHREAD *)((char *)v22 + 152) && !*((_WORD *)v22 + 243) )
      KiCheckForKernelApcDelivery();
    Key = v30;
  }
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  v24 = Src[1];
  if( Src[1] && Src[1] != Src[0] && Src[1] != result )
  {
    if( (v57 & 1) != 0 )
    {
      ++dword_140CDB49C;
      if( (unsigned __int16)CmpBounceBufferLookaside >= (unsigned __int16)word_140CDB490 )
      {
        ++dword_140CDB4A0;
        ((void(__fastcall *)(void *, __int16 *))qword_140CDB4B8)(Src[1], &CmpBounceBufferLookaside);
      }
      else
      {
        RtlpInterlockedPushEntrySList((PSLIST_HEADER)&CmpBounceBufferLookaside, (PSLIST_ENTRY)Src[1]);
      }
    }
    else
    {
      CmSiFreeMemory((PPRIVILEGE_SET)Src[1]);
    }
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v24) = 13;
    (*(void(__fastcall **)(void *, LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      v24,
      v59,
      (unsigned int)Key,
      (unsigned int)KeyInformationClass,
      v39,
      0i64);
  }
  if( v34 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    return v30;
  }
  return Key;
}

Referenced by: