NtRenameKey

NTSTATUS __stdcall NtRenameKey(PVOID KeyHandle, _UNICODE_STRING *NewName){
  char v3; 
  unsigned int v4; 
  char v5; 
  char v6; 
  _ETHREAD *CurrentThread; 
  bool v8; 
  NTSTATUS v9; 
  char v10; 
  int v11; 
  wchar_t *Buffer; 
  unsigned __int64 v13; 
  unsigned __int16 v14; 
  PPRIVILEGE_SET v15; 
  INT64 v16; 
  INT8 v17; 
  PVOID *v18; 
  unsigned int v19; 
  PVOID v20; 
  INT8 v21; 
  PVOID *v22; 
  _ETHREAD *v23; 
  int v24; 
  NTSTATUS v26; 
  bool v27; 
  PADAPTER_OBJECT DmaAdapter[2]; 
  void *Src[2]; 
  int v30; 
  PPRIVILEGE_SET Privileges; 
  __int64 a6[2]; 
  PVOID Handle; 
  __int128 v34; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  SLIST_ENTRY *Argument[2]; 
  __int128 v37; 
  __int64 v38; 
  _UNICODE_STRING NewKeyName; 
  KAPC_STATE ApcState; 
  Handle = KeyHandle;
  *(_OWORD *)Src = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v3 = 0;
  DmaAdapter[0] = 0i64;
  Privileges = 0i64;
  v4 = *((char *)KeGetCurrentThread() + 562);
  v5 = 0;
  *(_OWORD *)Argument = 0i64;
  v37 = 0i64;
  v38 = 0i64;
  a6[1] = (__int64)a6;
  a6[0] = (__int64)a6;
  v30 = 0;
  v6 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v8 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  v27 = v8;
  if( !v8 )
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( !v8 )
  {
    v9 = -1073741431;
    v26 = -1073741431;
    v10 = 0;
    goto LABEL_45;
  }
  if( (_BYTE)v4 == 1 )
  {
    v34 = 0i64;
    if( (unsigned __int64)NewName >= 0x7FFFFFFF0000i64 )
      NewName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
    v11 = *(_DWORD *)&NewName->Length;
    LODWORD(v34) = v11;
    Buffer = NewName->Buffer;
    *((_QWORD *)&v34 + 1) = Buffer;
    *(_OWORD *)Src = v34;
    if( (_WORD)v11 )
    {
      if( ((unsigned __int8)Buffer & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      v13 = (unsigned __int64)Buffer + (unsigned __int16)v11;
      if( v13 > 0x7FFFFFFF0000i64 || v13 < (unsigned __int64)Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    *(_UNICODE_STRING *)Src = *NewName;
  }
  v14 = (unsigned __int16)Src[0];
  if( (unsigned __int16)(LOWORD(Src[0]) - 1) > 0x1FFu || ((__int64)Src[0] & 1) != 0 )
  {
    v9 = -1073741811;
    v26 = -1073741811;
    v10 = 0;
    goto LABEL_45;
  }
  v15 = (PPRIVILEGE_SET)Src[1];
  if( CmpDoesBufferRequireCapturing(v4, Src[1]) )
  {
    Privileges = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithQuotaTag(v16, LOWORD(Src[0]), 0x426E4D43ui64);
    if( !Privileges )
    {
      v9 = -1073741670;
      v26 = -1073741670;
      v10 = 0;
      goto LABEL_45;
    }
    v15 = Privileges;
    memmove((UINT8 *)Privileges, (UINT8 *)Src[1], LOWORD(Src[0]));
    Src[1] = Privileges;
    v14 = (unsigned __int16)Src[0];
    WORD1(Src[0]) = Src[0];
  }
  v19 = 0;
  if( v14 >> 1 )
  {
    while( LOWORD(v15->PrivilegeCount) != 92 )
    {
      ++v19;
      v15 = (PPRIVILEGE_SET)((char *)v15 + 2);
      if( v19 >= v14 >> 1 )
        goto LABEL_24;
    }
    v9 = -1073741811;
    goto LABEL_28;
  }
LABEL_24:
  LOBYTE(v18) = v4;
  v20 = Handle;
  v9 = CmObReferenceObjectByHandle(Handle, 0x20006ui64, v17, v18, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
  v26 = v9;
  if( v9 == -1073741790 )
  {
    SeCaptureSubjectContext(&SubjectContext);
    v6 = 1;
    if( !CmDoVirtualTest((UINT64 *)&SubjectContext) )
      goto LABEL_26;
    LOBYTE(v22) = v4;
    v9 = CmObReferenceObjectByHandle(v20, 0x20019ui64, v21, v22, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
    v26 = v9;
    if( v9 < 0 )
      goto LABEL_29;
    if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter[0]) )
    {
LABEL_26:
      v9 = -1073741790;
LABEL_28:
      v26 = v9;
LABEL_29:
      v10 = 0;
      goto LABEL_45;
    }
    v5 = 1;
  }
  v6 = v5;
  if( v9 < 0 )
    goto LABEL_29;
  v23 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v23 + 242);
  v10 = 1;
  if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
  {
    Argument[0] = (SLIST_ENTRY *)DmaAdapter[0];
    Argument[1] = (SLIST_ENTRY *)Src;
    v24 = CmpCallCallBacksEx(RegNtRenameKey, Argument, 0i64, 1, RegNtPostRenameKey, (INT64)DmaAdapter[0], (INT64)a6);
    v9 = v24;
    if( v24 < 0 )
    {
      if( v24 == -1073740541 )
        v9 = 0;
      v26 = v9;
      goto LABEL_45;
    }
    v3 = 1;
  }
  if( !v5
    || (v9 = CmKeyBodyReplicateToVirtual((__int64 *)DmaAdapter, v4, 0x20006u, (__int64 *)&SubjectContext),
        v26 = v9,
        v9 >= 0) )
  {
    CmpAttachToRegistryProcess(&ApcState);
    NewKeyName = *(_UNICODE_STRING *)Src;
    v9 = CmRenameKey((_CM_KEY_BODY *)DmaAdapter[0], &NewKeyName, v4);
    v26 = v9;
    KiUnstackDetachProcess(&ApcState, 0i64);
    v6 = v5;
  }
LABEL_45:
  if( v6 )
    SeReleaseSubjectContext(&SubjectContext);
  if( v3 )
  {
    v9 = CmPostCallbackNotificationEx(
           RegNtPostRenameKey,
           (SLIST_ENTRY *)DmaAdapter[0],
           (unsigned int)v9,
           (INT64)Argument,
           0i64,
           (INT64)a6);
    v26 = v9;
  }
  if( v10 )
  {
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    v9 = v26;
  }
  if( DmaAdapter[0] )
    HalPutDmaAdapter(DmaAdapter[0]);
  if( Privileges )
    CmSiFreeMemory(Privileges);
  if( v27 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    return v26;
  }
  return v9;
}

Referenced by: