NtNotifyChangeMultipleKeys
NTSTATUS __stdcall NtNotifyChangeMultipleKeys(
HANDLE MasterKeyHandle,
ULONG Count,
OBJECT_ATTRIBUTES SubordinateObjects[],
HANDLE Event,
PIO_APC_ROUTINE ApcRoutine,
PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock,
ULONG CompletionFilter,
BOOLEAN WatchTree,
PVOID Buffer,
ULONG BufferSize,
BOOLEAN Asynchronous){
__int64 *v13;
unsigned int v14;
PVOID *v15;
INT8 v16;
char v17;
NTSTATUS v18;
PADAPTER_OBJECT v19;
void *v20;
__int64 v21;
unsigned int v22;
UINT64 v23;
UINT8 v24;
UINT8 v25;
PADAPTER_OBJECT v26;
PADAPTER_OBJECT *v27;
_DMA_OPERATIONS **p_DmaOperations;
_DMA_OPERATIONS *DmaOperations;
__int64 v30;
_CM_KEY_CONTROL_BLOCK *v31;
bool v32;
__int64 v34;
bool v35;
_ETHREAD *CurrentThread;
void *v37;
__int64 v38;
__int64 v39;
unsigned __int64 AllocateAdapterChannel;
_DMA_OPERATIONS *v41;
unsigned __int64 v42;
__int16 v43;
_CM_KEY_CONTROL_BLOCK *v44;
void *v45;
__int64 v46;
_CM_KEY_CONTROL_BLOCK *v47;
__int64 v48;
_QWORD *v49;
OBJECT_ATTRIBUTES *__attribute__((__org_arrdim(0,0))) CurrentIrql;
__int64 v51;
_QWORD *v52;
NTSTATUS v53;
unsigned __int8 v54;
__int64 v55;
__int64 **v56;
__int64 v57;
__int64 **v58;
__int64 v59;
_QWORD *v60;
__int64 v61;
_QWORD *v62;
PIO_STATUS_BLOCK v63;
unsigned __int8 v64;
__int64 v65;
__int64 **v66;
__int64 v67;
__int64 **v68;
__int64 v69;
_QWORD *v70;
__int64 v71;
_QWORD *v72;
PVOID *Object;
IRP *Objecta;
PVOID *Objectb;
POBJECT_HANDLE_INFORMATION HandleInformation;
POBJECT_HANDLE_INFORMATION HandleInformationa;
bool v78;
char AccessMode;
bool v80;
bool v81;
unsigned int P;
int Handlea;
PADAPTER_OBJECT DmaAdapter;
int(__fastcall *v86)(_DMA_ADAPTER *, _DEVICE_OBJECT *, unsigned int, _IO_ALLOCATION_ACTION(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *, void *), void *);
PADAPTER_OBJECT v87;
PADAPTER_OBJECT v88;
PVOID v89;
OBJECT_ATTRIBUTES *__attribute__((__org_arrdim(0,0))) v90;
PVOID VirtualAddress;
PIO_STATUS_BLOCK v92;
__int64 v93;
int v94;
INT64 result[12];
int v96;
_QWORD v97[9];
INT64 v98[11];
v90 = SubordinateObjects;
v89 = MasterKeyHandle;
v92 = IoStatusBlock;
DmaAdapter = 0i64;
v88 = 0i64;
v13 = 0i64;
v93 = 0i64;
v14 = 1;
P = 1;
memset((INT64)result, 0i64);
v81 = 0;
v86 = 0i64;
v94 = 0;
v78 = CmpAcquireShutdownRundown();
if( !v78 )
return -1073741431;
v16 = 1;
if( Count <= 1 )
{
v17 = *((_BYTE *)KeGetCurrentThread() + 562);
AccessMode = v17;
if( v17 )
{
if( (CompletionFilter & 0x10000000) != 0 )
{
if( Asynchronous && !ApcRoutine && Event )
{
v14 = 4;
LABEL_9:
P = v14;
goto LABEL_10;
}
goto LABEL_83;
}
v34 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1408i64);
v35 = 0;
if( v34 )
{
v43 = *(_WORD *)(v34 + 8);
if( v43 == 332 || v43 == 452 )
v35 = 1;
}
v81 = v35;
ProbeForWrite(IoStatusBlock, 8 * !v35 + 8i64, 4ui64);
ProbeForWrite(Buffer, BufferSize, 4ui64);
if( v35 )
{
IoStatusBlock->Pointer = (void *)259;
}
else
{
IoStatusBlock->Status = 259;
IoStatusBlock->Information = 0i64;
}
v17 = AccessMode;
if( Asynchronous )
{
v14 = 2;
goto LABEL_9;
}
LABEL_10:
if( CompletionFilter != (CompletionFilter & 0x1000000F) )
{
v18 = -1073741811;
goto LABEL_39;
}
HandleInformation = 0i64;
LOBYTE(v15) = v17;
v18 = CmObReferenceObjectByHandle(v89, 0x10ui64, v16, v15, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
if( v18 < 0 )
{
LABEL_39:
CmpReleaseShutdownRundown();
return v18;
}
v19 = 0i64;
v87 = 0i64;
if( Count == 1 )
{
v96 = -1;
v97[1] = v97;
v97[0] = v97;
memset((INT64)v98, 0i64);
v18 = CmObReferenceObjectByName((__int64)v90, 0i64, 0x10u, v38, AccessMode, (__int64)result, &v87);
CmpCleanupParseContext((__int64)result, 0);
if( v18 < 0 )
goto LABEL_37;
v19 = v87;
if( DmaAdapter->DmaOperations->AllocateAdapterChannel == v87->DmaOperations->AllocateAdapterChannel )
{
HalPutDmaAdapter(v87);
v18 = -1073741811;
goto LABEL_37;
}
}
CmpAllocatePostBlock((PVOID)v14);
v21 = (__int64)v20;
v89 = v20;
if( !v20 )
{
if( Count == 1 )
HalPutDmaAdapter(v19);
goto LABEL_90;
}
if( Count == 1 )
{
CmpAllocatePostBlock((PVOID)P);
v13 = (__int64 *)v39;
v93 = v39;
if( !v39 )
{
HalPutDmaAdapter(v19);
CmpFreePostBlock((PVOID)v21);
LABEL_90:
v18 = -1073741670;
goto LABEL_37;
}
}
v22 = P;
if( P != 1 )
{
if( Event )
{
VirtualAddress = 0i64;
v18 = ObReferenceObjectByHandle(Event, 2u, (POBJECT_TYPE)ExEventObjectType, AccessMode, &VirtualAddress, 0i64);
v88 = (PADAPTER_OBJECT)VirtualAddress;
if( v18 < 0 )
{
if( Count != 1 )
{
LABEL_93:
v45 = (void *)v21;
LABEL_94:
CmpFreePostBlock(v45);
goto LABEL_37;
}
LABEL_92:
CmpFreePostBlock(v13);
goto LABEL_93;
}
KeResetEvent(VirtualAddress, v23, v24, v25, Objecta);
v22 = P;
}
v26 = v88;
v27 = *(PADAPTER_OBJECT **)(v21 + 64);
if( v22 == 2 )
{
v27[13] = (PADAPTER_OBJECT)IoStatusBlock;
*(_QWORD *)(*(_QWORD *)(v21 + 64) + 8i64) = v26;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v37 = AlpcMessageDeleteProcedure;
if( ApcRoutine )
v37 = ApcRoutine;
KeInitializeApc(
*(_QWORD *)(v21 + 64) + 16i64,
(INT64)CurrentThread,
2i64,
(INT64)CmpPostApc,
(INT64)CmpPostApcRunDown,
(INT64)v37,
ApcRoutine != 0i64 ? AccessMode : 0,
(INT64)ApcContext);
v19 = v87;
}
else
{
*v27 = v88;
if( v22 != 4 )
{
*(_QWORD *)(*(_QWORD *)(v21 + 64) + 8i64) = ApcRoutine;
*(_DWORD *)(*(_QWORD *)(v21 + 64) + 16i64) = (_DWORD)ApcContext;
}
}
}
CmpLockRegistry();
p_DmaOperations = &DmaAdapter->DmaOperations;
DmaOperations = DmaAdapter->DmaOperations;
if( Count == 1 )
CmpLockTwoKcbsShared((_CM_KEY_CONTROL_BLOCK *)DmaOperations, (_CM_KEY_CONTROL_BLOCK *)v19->DmaOperations);
else
CmpLockKcbShared((_CM_KEY_CONTROL_BLOCK *)DmaOperations);
if( !CmpIsKeyDeletedForKeyBody((__int64)DmaAdapter, 0i64) )
{
if( Count != 1 )
{
LABEL_26:
CmLockHive((__int64)(*p_DmaOperations)->AllocateAdapterChannel);
Handlea = 1;
goto LABEL_27;
}
if( !CmpIsKeyDeletedForKeyBody((__int64)v19, 0i64) )
{
AllocateAdapterChannel = (unsigned __int64)(*p_DmaOperations)->AllocateAdapterChannel;
v41 = v19->DmaOperations;
v42 = (unsigned __int64)v41->AllocateAdapterChannel;
if( AllocateAdapterChannel < v42 )
{
CmLockHive(AllocateAdapterChannel);
CmLockHive((__int64)v19->DmaOperations->AllocateAdapterChannel);
Handlea = 2;
}
else
{
if( AllocateAdapterChannel == v42 )
goto LABEL_26;
CmLockHive((__int64)v41->AllocateAdapterChannel);
CmLockHive((__int64)(*p_DmaOperations)->AllocateAdapterChannel);
Handlea = 3;
}
v86 = v19->DmaOperations->AllocateAdapterChannel;
LABEL_27:
LOCK_POST_LIST();
v18 = CmpNotifyChangeKey(
(__int64)DmaAdapter,
(_QWORD *)v21,
CompletionFilter,
WatchTree,
(__int64)Object,
(__int64)HandleInformation,
v21);
if( v18 >= 0 )
{
v80 = Count == 1;
if( Count == 1 )
{
ObfReferenceObject(v19);
if( v18 )
{
v18 = CmpNotifyChangeKey(
(__int64)v19,
v13,
CompletionFilter,
WatchTree,
(__int64)Objectb,
(__int64)HandleInformationa,
v21);
v80 = Count == 1;
if( v18 < 0 )
{
v48 = *(_QWORD *)v21;
v49 = *(_QWORD **)(v21 + 8);
if( *(_QWORD *)(*(_QWORD *)v21 + 8i64) != v21 )
goto LABEL_151;
if( *v49 != v21 )
goto LABEL_151;
*v49 = v48;
*(_QWORD *)(v48 + 8) = v49;
CurrentIrql = (OBJECT_ATTRIBUTES *)KeGetCurrentIrql();
v90 = CurrentIrql;
__writecr8(1ui64);
v51 = *(_QWORD *)(v21 + 16);
v52 = *(_QWORD **)(v21 + 24);
if( *(_QWORD *)(v51 + 8) != v21 + 16 || *v52 != v21 + 16 )
goto LABEL_151;
*v52 = v51;
*(_QWORD *)(v51 + 8) = v52;
__writecr8((unsigned __int8)CurrentIrql);
v80 = Count == 1;
}
}
else
{
CmpFreePostBlock(v13);
v80 = 0;
}
}
UNLOCK_POST_LIST();
if( Handlea != 1 )
{
if( Handlea != 2 )
{
CmUnlockHive((__int64)(*p_DmaOperations)->AllocateAdapterChannel);
v30 = (__int64)v86;
LABEL_31:
CmUnlockHive(v30);
v31 = (_CM_KEY_CONTROL_BLOCK *)*p_DmaOperations;
if( Count == 1 )
CmpUnlockTwoKcbs(v31, (_CM_KEY_CONTROL_BLOCK *)v19->DmaOperations);
else
CmpUnlockKcb((UINT64)v31);
CmpUnlockRegistry();
if( v19 )
HalPutDmaAdapter(v19);
if( v18 < 0 )
{
CmpFreePostBlock((PVOID)v21);
if( v88 )
HalPutDmaAdapter(v88);
goto LABEL_37;
}
if( P != 1 )
{
LABEL_37:
v32 = v78;
goto LABEL_38;
}
CmpReleaseShutdownRundown();
v78 = 0;
v53 = KeWaitForSingleObject(*(PVOID *)(v21 + 64), Executive, AccessMode, 1u, 0i64);
v18 = v53;
if( v53 != 257 && v53 != 192 )
{
CmpLockRegistry();
LOCK_POST_LIST();
v54 = KeGetCurrentIrql();
__writecr8(1ui64);
if( v80 )
{
v55 = *v13;
if( *v13 )
{
v56 = (__int64 **)v13[1];
if( *(__int64 **)(v55 + 8) != v13 || *v56 != v13 )
goto LABEL_151;
*v56 = (__int64 *)v55;
*(_QWORD *)(v55 + 8) = v56;
}
v57 = v13[2];
v58 = (__int64 **)v13[3];
if( *(__int64 **)(v57 + 8) != v13 + 2 || *v58 != v13 + 2 )
goto LABEL_151;
*v58 = (__int64 *)v57;
*(_QWORD *)(v57 + 8) = v58;
}
v59 = *(_QWORD *)v21;
if( *(_QWORD *)v21 )
{
v60 = *(_QWORD **)(v21 + 8);
if( *(_QWORD *)(v59 + 8) != v21 || *v60 != v21 )
goto LABEL_151;
*v60 = v59;
*(_QWORD *)(v59 + 8) = v60;
}
v61 = *(_QWORD *)(v21 + 16);
v62 = *(_QWORD **)(v21 + 24);
if( *(_QWORD *)(v61 + 8) == v21 + 16 && *v62 == v21 + 16 )
{
*v62 = v61;
*(_QWORD *)(v61 + 8) = v62;
__writecr8(v54);
UNLOCK_POST_LIST();
CmpUnlockRegistry();
v18 = *(_DWORD *)(*(_QWORD *)(v21 + 64) + 24i64);
v63 = v92;
v92->Status = v18;
if( v81 )
HIDWORD(v63->Pointer) = 0;
else
v63->Information = 0i64;
v32 = 0;
if( v80 )
CmpFreePostBlock(v13);
CmpFreePostBlock((PVOID)v21);
LABEL_38:
HalPutDmaAdapter(DmaAdapter);
if( !v32 )
return v18;
goto LABEL_39;
}
LABEL_151:
__fastfail(3u);
}
CmpLockRegistry();
LOCK_POST_LIST();
v64 = KeGetCurrentIrql();
__writecr8(1ui64);
if( v80 )
{
v65 = *v13;
if( *v13 )
{
v66 = (__int64 **)v13[1];
if( *(__int64 **)(v65 + 8) != v13 || *v66 != v13 )
goto LABEL_151;
*v66 = (__int64 *)v65;
*(_QWORD *)(v65 + 8) = v66;
}
v67 = v13[2];
v68 = (__int64 **)v13[3];
if( *(__int64 **)(v67 + 8) != v13 + 2 || *v68 != v13 + 2 )
goto LABEL_151;
*v68 = (__int64 *)v67;
*(_QWORD *)(v67 + 8) = v68;
}
v69 = *(_QWORD *)v21;
if( *(_QWORD *)v21 )
{
v70 = *(_QWORD **)(v21 + 8);
if( *(_QWORD *)(v69 + 8) != v21 || *v70 != v21 )
goto LABEL_151;
*v70 = v69;
*(_QWORD *)(v69 + 8) = v70;
}
v71 = *(_QWORD *)(v21 + 16);
v72 = *(_QWORD **)(v21 + 24);
if( *(_QWORD *)(v71 + 8) != v21 + 16 || *v72 != v21 + 16 )
goto LABEL_151;
*v72 = v71;
*(_QWORD *)(v71 + 8) = v72;
__writecr8(v64);
UNLOCK_POST_LIST();
CmpUnlockRegistry();
if( !v80 )
goto LABEL_93;
goto LABEL_92;
}
CmUnlockHive((__int64)v86);
}
v30 = (__int64)(*p_DmaOperations)->AllocateAdapterChannel;
goto LABEL_31;
}
UNLOCK_POST_LIST();
if( Handlea != 1 )
{
if( Handlea != 2 )
{
CmUnlockHive((__int64)(*p_DmaOperations)->AllocateAdapterChannel);
v46 = (__int64)v86;
goto LABEL_100;
}
CmUnlockHive((__int64)v86);
}
v46 = (__int64)(*p_DmaOperations)->AllocateAdapterChannel;
LABEL_100:
CmUnlockHive(v46);
v47 = (_CM_KEY_CONTROL_BLOCK *)*p_DmaOperations;
if( Count == 1 )
CmpUnlockTwoKcbs(v47, (_CM_KEY_CONTROL_BLOCK *)v19->DmaOperations);
else
CmpUnlockKcb((UINT64)v47);
CmpUnlockRegistry();
if( v88 )
HalPutDmaAdapter(v88);
if( Count != 1 )
goto LABEL_37;
v45 = v13;
goto LABEL_94;
}
}
v44 = (_CM_KEY_CONTROL_BLOCK *)*p_DmaOperations;
if( Count == 1 )
CmpUnlockTwoKcbs(v44, (_CM_KEY_CONTROL_BLOCK *)v19->DmaOperations);
else
CmpUnlockKcb((UINT64)v44);
CmpUnlockRegistry();
if( v88 )
HalPutDmaAdapter(v88);
if( Count == 1 )
CmpFreePostBlock(v13);
CmpFreePostBlock((PVOID)v21);
v18 = -1073741444;
goto LABEL_37;
}
if( !Asynchronous )
goto LABEL_10;
v14 = 3;
P = 3;
if( !Count )
goto LABEL_10;
}
LABEL_83:
CmpReleaseShutdownRundown();
return -1073741811;
}Referenced by:
NtNotifyChangeKey