NtDeleteKey

NTSTATUS __stdcall NtDeleteKey(PVOID Handle){
  __int64 v1; 
  char v3; 
  char v4; 
  char v5; 
  char v6; 
  _ETHREAD *CurrentThread; 
  INT8 v8; 
  PVOID *v9; 
  _DMA_OPERATIONS *v10; 
  NTSTATUS v11; 
  PADAPTER_OBJECT v12; 
  _ETHREAD *v13; 
  unsigned int(__fastcall *GetDmaAlignment)(_DMA_ADAPTER *); 
  INT8 v16; 
  PVOID *v17; 
  NTSTATUS v18; 
  int v19; 
  GUID *p_TransactionId; 
  bool v21; 
  PADAPTER_OBJECT DmaAdapter; 
  int v23; 
  __int64 v24; 
  _DMA_OPERATIONS *DmaOperations; 
  _CM_TRANS *CmTrans; 
  INT64 a6[2]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  SLIST_ENTRY *Argument[2]; 
  __int128 v30; 
  GUID TransactionId; 
  LARGE_INTEGER v32[2]; 
  __int128 v33; 
  v1 = 0i64;
  v24 = 0i64;
  DmaOperations = 0i64;
  v3 = 0;
  v23 = 0;
  *(_OWORD *)Argument = 0i64;
  CmTrans = 0i64;
  v30 = 0i64;
  *(_OWORD *)&v32[0].LowPart = 0i64;
  v33 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp(v32, 0x20000ui64);
  DmaAdapter = 0i64;
  a6[1] = (INT64)a6;
  v4 = 0;
  a6[0] = (INT64)a6;
  v5 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v6 = *((_BYTE *)KeGetCurrentThread() + 562);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v21 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  if( !v21 )
  {
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    v11 = -1073741431;
    goto LABEL_32;
  }
  LOBYTE(v9) = v6;
  v11 = CmObReferenceObjectByHandle(Handle, 0x10000ui64, v8, v9, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
  if( v11 == -1073741790 )
  {
    SeCaptureSubjectContext(&SubjectContext);
    if( !CmDoVirtualTest((UINT64 *)&SubjectContext) )
    {
      v11 = -1073741790;
      v12 = DmaAdapter;
      goto LABEL_40;
    }
    LOBYTE(v17) = v6;
    v18 = CmObReferenceObjectByHandle(Handle, 0x20019ui64, v16, v17, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
    v12 = DmaAdapter;
    v11 = v18;
    if( v18 < 0 )
      goto LABEL_40;
    if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter) )
    {
      v11 = -1073741790;
      goto LABEL_40;
    }
    v3 = 1;
  }
  else
  {
    v12 = DmaAdapter;
  }
  if( v11 >= 0 )
  {
    v13 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v13 + 242);
    v12 = DmaAdapter;
    v11 = 0;
    v5 = 1;
    if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
    {
      Argument[0] = (SLIST_ENTRY *)v12;
      v11 = CmpCallCallBacksEx(RegNtDeleteKey, Argument, 0i64, 1, RegNtPostDeleteKey, (INT64)v12, (INT64)a6);
      if( v11 < 0 )
      {
        if( v11 == -1073740541 )
          v11 = 0;
        goto LABEL_24;
      }
      v4 = 1;
      v11 = 0;
    }
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && v12 )
      DmaOperations = v12->DmaOperations;
    ExAcquirePushLockSharedEx((UINT64)&ExpKeyManipLock, 0i64);
    if( ExpControlKey && v12->DmaOperations == ExpControlKey->DmaOperations
      || ::DmaAdapter && v12->DmaOperations == ::DmaAdapter->DmaOperations )
    {
      if( _InterlockedCompareExchange64((volatile signed __int64 *)&ExpKeyManipLock, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)&ExpKeyManipLock);
      KeAbPostRelease(&ExpKeyManipLock);
      v12 = DmaAdapter;
    }
    else
    {
      if( _InterlockedCompareExchange64((volatile signed __int64 *)&ExpKeyManipLock, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)&ExpKeyManipLock);
      KeAbPostRelease(&ExpKeyManipLock);
      v12 = DmaAdapter;
      v10 = DmaAdapter->DmaOperations;
      if( (LODWORD(v10->PutDmaAdapter) & 0x80u) != 0 )
        goto LABEL_55;
      GetDmaAlignment = v10->GetDmaAlignment;
      if( GetDmaAlignment )
      {
        if( (*((_DWORD *)GetDmaAlignment + 2) & 0x80u) != 0 )
          goto LABEL_55;
      }
      if( !v3 )
        goto LABEL_22;
      v19 = CmKeyBodyRemapToVirtual((__int64 *)&DmaAdapter, v6, 0x10000u, (__int64)&SubjectContext, &v23);
      v12 = DmaAdapter;
      v11 = v19;
      if( v19 < 0 )
        goto LABEL_24;
      if( CmpVEEnabled && ((__int64)DmaAdapter->DmaOperations->MapTransferEx & 0x1000000) != 0 )
      {
LABEL_22:
        v11 = CmDeleteKey(v12);
        if( v11 >= 0 && (v24 & 4) != 0 )
        {
          if( v12[3].DmaOperations || *(_QWORD *)&v12[4].Version )
          {
            CmpLockRegistry();
            CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)v12, &CmTrans);
            TransactionId = CmTrans->KtmUow;
            CmpUnlockRegistry();
            p_TransactionId = &TransactionId;
          }
          else
          {
            p_TransactionId = 0i64;
          }
          SeDeleteObjectAuditAlarmWithTransaction(v12, Handle, p_TransactionId);
        }
      }
      else
      {
LABEL_55:
        v11 = -1073741790;
      }
    }
  }
LABEL_24:
  if( v3 )
LABEL_40:
    SeReleaseSubjectContext(&SubjectContext);
  if( v4 )
    v11 = CmPostCallbackNotificationEx(
            RegNtPostDeleteKey,
            (SLIST_ENTRY *)v12,
            (unsigned int)v11,
            (INT64)Argument,
            0i64,
            (INT64)a6);
  if( v5 )
  {
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    v12 = DmaAdapter;
  }
  if( v12 )
    HalPutDmaAdapter(v12);
  v1 = (__int64)DmaOperations;
LABEL_32:
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v10) = 12;
    (*(void(__fastcall **)(_DMA_OPERATIONS *, LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag
                                                                                                + 7))(
      v10,
      v32,
      (unsigned int)v11,
      0i64,
      v1,
      0i64);
  }
  if( v21 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  return v11;
}

Referenced by: