NtQueryValueKey
INT64 __fastcall NtQueryValueKey(
VOID *KeyHandle,
_UNICODE_STRING *ValueName,
_KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
VOID *KeyValueInformation,
UINT64 Length,
UINT64 *ResultLength){
unsigned int v10;
_ETHREAD *CurrentThread;
bool v12;
KPROCESSOR_MODE v13;
int v14;
INT64 v15;
_DMA_OPERATIONS *DmaOperations;
int v17;
wchar_t *Buffer;
unsigned __int64 v19;
UINT64 v20;
UINT8 *v21;
_ETHREAD *v22;
ULONG IsResourceAcquiredSharedLite;
_DWORD *v24;
int v25;
INT64 v26;
__int64 v27;
int v28;
unsigned int v29;
_ETHREAD *v30;
bool v31;
PSLIST_ENTRY v33;
VOID *TransientPoolWithQuotaTag;
void *v35;
KPROCESSOR_MODE v36;
unsigned int v37;
char v38;
int ValueKey;
struct _UNICODE_STRING *p_DestinationString;
unsigned int v41;
char v42;
char v43;
char v44;
bool v45;
_KEY_VALUE_INFORMATION_CLASS v46;
struct _UNICODE_STRING DestinationString;
_DMA_OPERATIONS *v48;
size_t Size;
PADAPTER_OBJECT DmaAdapter;
PPRIVILEGE_SET Privileges;
_KEY_VALUE_INFORMATION_CLASS v52;
INT64 a1;
_DMA_OPERATIONS *v54;
PADAPTER_OBJECT v55;
INT64 v56[2];
PVOID v57;
PVOID Object;
PVOID v59;
__int64 v60;
__int64 v61;
struct _UNICODE_STRING v62;
SLIST_ENTRY *Argument[2];
__int128 v64;
__int128 v65;
__int128 v66;
__int64 v67;
SLIST_ENTRY *v68;
int v69;
int v70;
SLIST_ENTRY **v71;
int v72;
__int128 v73;
__int64 v74;
int v75;
__int64 v76;
struct _UNICODE_STRING v77;
struct _UNICODE_STRING v78;
void *Src[2];
char v80;
INT64 result[2];
__int128 v82;
__int128 v83;
__int128 v84;
int v85;
__int16 v86;
char v87;
LARGE_INTEGER v88[2];
__int128 v89;
struct _EVENT_DATA_DESCRIPTOR v90;
__int64 *v91;
__int64 v92;
char *v93;
__int64 v94;
__int64 *v95;
__int64 v96;
char v97[64];
v46 = KeyValueInformationClass;
v10 = Length;
v52 = KeyValueInformationClass;
a1 = (INT64)ResultLength;
DestinationString = 0i64;
*(_OWORD *)result = 0i64;
v82 = 0i64;
v83 = 0i64;
v84 = 0i64;
v85 = 0;
v86 = 0;
v87 = 0;
*(_OWORD *)&v88[0].LowPart = 0i64;
v89 = 0i64;
v48 = 0i64;
v54 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(v88, 0x20000ui64);
v42 = 0;
v43 = 0;
DmaAdapter = 0i64;
LODWORD(Size) = 0;
RtlInitUnicodeString(&DestinationString, 0i64, KeyValueInformationClass);
Privileges = 0i64;
*(_OWORD *)Argument = 0i64;
v64 = 0i64;
v65 = 0i64;
v66 = 0i64;
v67 = 0i64;
*(_OWORD *)Src = 0i64;
v80 = 0;
v56[1] = (INT64)v56;
v56[0] = (INT64)v56;
v55 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v12 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
if( !v12 )
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v45 = v12;
if( !v12 )
{
v14 = -1073741431;
v41 = -1073741431;
goto LABEL_119;
}
if( (unsigned int)KeyValueInformationClass > KeyValuePartialInformationAlign64 )
{
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7)
&& KeyHandle
&& (v36 = *((_BYTE *)KeGetCurrentThread() + 562),
v57 = 0i64,
ObReferenceObjectByHandle(KeyHandle, 0, (POBJECT_TYPE)CmKeyObjectType, v36, &v57, 0i64) >= 0) )
{
DmaOperations = (_DMA_OPERATIONS *)*((_QWORD *)v57 + 1);
HalPutDmaAdapter((PADAPTER_OBJECT)v57);
}
else
{
DmaOperations = 0i64;
}
v14 = -1073741811;
v41 = -1073741811;
goto LABEL_79;
}
v13 = *((_BYTE *)KeGetCurrentThread() + 562);
v76 = 0i64;
Object = 0i64;
v14 = ObReferenceObjectByHandle(KeyHandle, 1u, (POBJECT_TYPE)CmKeyObjectType, v13, &Object, 0i64);
v15 = (INT64)Object;
v59 = Object;
if( v14 >= 0 )
{
if( *(_DWORD *)Object == 1803104306 )
{
DmaAdapter = (PADAPTER_OBJECT)Object;
v15 = 0i64;
v59 = 0i64;
v14 = 0;
}
else
{
v14 = -1073741816;
}
}
if( v15 )
HalPutDmaAdapter((PADAPTER_OBJECT)v15);
v41 = v14;
if( v14 < 0 )
{
LABEL_119:
DmaOperations = 0i64;
goto LABEL_79;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && (v15 = (INT64)DmaAdapter) != 0 )
{
DmaOperations = DmaAdapter->DmaOperations;
v48 = DmaOperations;
v54 = DmaOperations;
}
else
{
DmaOperations = 0i64;
}
if( v13 == 1 )
{
v62 = 0i64;
if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
ValueName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
v17 = *(_DWORD *)&ValueName->Length;
*(_DWORD *)&v62.Length = v17;
Buffer = ValueName->Buffer;
v62.Buffer = Buffer;
DestinationString = v62;
if( (_WORD)v17 )
{
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v19 = (unsigned __int64)Buffer + (unsigned __int16)v17;
if( v19 > 0x7FFFFFFF0000i64 || v19 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (_DWORD)Length )
{
if( ((unsigned __int8)KeyValueInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)KeyValueInformation + (unsigned int)Length > 0x7FFFFFFF0000i64
|| (char *)KeyValueInformation + (unsigned int)Length < KeyValueInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v15 = a1;
if( (unsigned __int64)a1 >= 0x7FFFFFFF0000i64 )
v15 = 0x7FFFFFFF0000i64;
*(_DWORD *)v15 = *(_DWORD *)v15;
}
else
{
DestinationString = *ValueName;
}
v20 = DestinationString.Length;
DestinationString.MaximumLength = DestinationString.Length;
v21 = (UINT8 *)DestinationString.Buffer;
if( v13 || *(&CmpRegistryProcess + 1) && !CmpIsBufferGloballyVisible(DestinationString.Buffer) )
{
if( (_WORD)v20 )
{
if( (unsigned int)v20 > 0x40 )
{
Privileges = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithQuotaTag(v15, v20, 0x6E764D43ui64);
if( !Privileges )
{
v14 = -1073741670;
v41 = -1073741670;
goto LABEL_79;
}
v21 = (UINT8 *)DestinationString.Buffer;
LOWORD(v20) = DestinationString.Length;
}
else
{
Privileges = (PPRIVILEGE_SET)v97;
}
if( Privileges )
{
memmove((UINT8 *)Privileges, v21, (unsigned __int16)v20);
LOWORD(v20) = DestinationString.Length;
}
}
else
{
Privileges = 0i64;
}
v21 = (UINT8 *)Privileges;
DestinationString.Buffer = (wchar_t *)Privileges;
}
if( (DestinationString.Length & 1) != 0 )
{
v14 = -1073741811;
v41 = -1073741811;
goto LABEL_79;
}
while( (_WORD)v20 && !*(_WORD *)&v21[2 * ((unsigned __int64)(unsigned __int16)v20 >> 1) - 2] )
{
LOWORD(v20) = v20 - 2;
DestinationString.Length = v20;
}
v22 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v22 + 242);
v43 = 1;
if( !CmpCallBackCount )
{
v24 = (_DWORD *)a1;
LABEL_58:
v14 = CmKeyBodyRemapToVirtualForEnum((__int64 *)&DmaAdapter, v13, 1u, (__int64 *)&v55);
v41 = v14;
if( v14 < 0 )
goto LABEL_72;
Src[0] = KeyValueInformation;
if( (_DWORD)Length )
{
if( *(&CmpRegistryProcess + 1) && (v13 || !CmpIsBufferGloballyVisible(KeyValueInformation)) )
{
if( (unsigned int)dword_140C02130 > 5 && (byte_140C02140 & 4) != 0 && (qword_140C02148 & 4) == qword_140C02148 )
{
v60 = 1i64;
v91 = &v60;
v92 = 8i64;
v44 = 3;
v93 = &v44;
v94 = 1i64;
v37 = Length;
if( (((_DWORD)Length - 1) & (unsigned int)Length) != 0 )
{
v38 = -1;
do
{
++v38;
v37 >>= 1;
}
while( v37 );
v37 = 1 << (v38 + 1);
}
v61 = v37;
v95 = &v61;
v96 = 8i64;
tlgWriteAgg((__int64)&dword_140C02130, (unsigned __int8 *)&byte_14002258B, v27, 5u, &v90);
}
if( (unsigned int)Length > 0x40ui64 )
{
if( (unsigned int)Length > 0x1000ui64 )
goto LABEL_115;
++dword_140CDB494;
v33 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)&CmpBounceBufferLookaside);
if( !v33 )
{
++dword_140CDB498;
v33 = (PSLIST_ENTRY)((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD, __int16 *))qword_140CDB4B0)(
(unsigned int)dword_140CDB4A4,
(unsigned int)dword_140CDB4AC,
(unsigned int)dword_140CDB4A8,
&CmpBounceBufferLookaside);
}
if( v33 )
{
memset((INT64)v33, 0i64);
v80 |= 1u;
Src[1] = v33;
}
else
{
LABEL_115:
TransientPoolWithQuotaTag = CmpAllocateTransientPoolWithQuotaTag(v26, (unsigned int)Length, 0x42424D43ui64);
v35 = TransientPoolWithQuotaTag;
if( !TransientPoolWithQuotaTag )
{
v14 = -1073741670;
goto LABEL_67;
}
memset((INT64)TransientPoolWithQuotaTag, 0i64);
Src[1] = v35;
}
}
else
{
memset((INT64)result, 0i64);
Src[1] = result;
}
}
else
{
Src[1] = KeyValueInformation;
}
}
else
{
Src[1] = 0i64;
}
v14 = 0;
LABEL_67:
v41 = v14;
if( v14 >= 0 )
{
if( !v55 )
goto LABEL_69;
v77 = DestinationString;
ValueKey = CmQueryValueKey((_DWORD)v55, (unsigned int)&v77, v46, Src[1], Length, (__int64)&Size);
v14 = ValueKey;
v41 = ValueKey;
if( ValueKey >= 0 || ValueKey == -1073741789 || ValueKey == -2147483643 )
{
LABEL_73:
v29 = Size;
*v24 = Size;
if( v14 != -1073741789 )
{
if( v29 < (unsigned int)Length )
v10 = v29;
if( Src[0] != Src[1] )
memmove((UINT8 *)Src[0], (UINT8 *)Src[1], v10);
}
DmaOperations = v48;
goto LABEL_79;
}
if( ValueKey == -1073741772 )
{
LABEL_69:
v78 = DestinationString;
v28 = CmQueryValueKey((_DWORD)DmaAdapter, (unsigned int)&v78, v46, Src[1], Length, (__int64)&Size);
v14 = v28;
v41 = v28;
if( v28 < 0 && v28 != -2147483643 && v28 != -1073741789 )
goto LABEL_72;
goto LABEL_73;
}
}
LABEL_72:
DmaOperations = v48;
goto LABEL_79;
}
IsResourceAcquiredSharedLite = ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock);
v24 = (_DWORD *)a1;
if( IsResourceAcquiredSharedLite )
goto LABEL_58;
Argument[0] = (SLIST_ENTRY *)DmaAdapter;
Argument[1] = (SLIST_ENTRY *)&DestinationString;
LODWORD(v64) = v46;
*((_QWORD *)&v64 + 1) = KeyValueInformation;
LODWORD(v65) = Length;
*((_QWORD *)&v65 + 1) = a1;
v25 = CmpCallCallBacksEx(RegNtQueryValueKey, Argument, 0i64, 1, RegNtPostQueryValueKey, (INT64)DmaAdapter, (INT64)v56);
v14 = v25;
v41 = v25;
if( v25 >= 0 )
{
v42 = 1;
goto LABEL_58;
}
DmaOperations = v48;
if( v25 == -1073740541 )
{
v14 = 0;
v41 = 0;
}
LABEL_79:
if( v55 )
HalPutDmaAdapter(v55);
if( v42 )
{
if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) && (INT64 *)v56[0] != v56 )
{
v70 = 0;
v73 = 0i64;
v74 = 0i64;
v75 = 0;
v68 = (SLIST_ENTRY *)DmaAdapter;
v69 = v14;
v72 = v14;
v71 = Argument;
CmpCallCallBacksEx(RegNtPostQueryValueKey, &v68, 0i64, 0, RegNtPostQueryValueKey, (INT64)DmaAdapter, (INT64)v56);
v14 = v72;
}
v41 = v14;
}
if( v43 )
{
v30 = (_ETHREAD *)KeGetCurrentThread();
v31 = (*((_WORD *)v30 + 242))++ == 0xFFFF;
if( v31 && *((_ETHREAD **)v30 + 19) != (_ETHREAD *)((char *)v30 + 152) && !*((_WORD *)v30 + 243) )
KiCheckForKernelApcDelivery();
v14 = v41;
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( Src[1] && Src[1] != Src[0] && Src[1] != result )
{
if( (v80 & 1) != 0 )
{
++dword_140CDB49C;
if( (unsigned __int16)CmpBounceBufferLookaside >= (unsigned __int16)word_140CDB490 )
{
++dword_140CDB4A0;
((void(__fastcall *)(void *, __int16 *))qword_140CDB4B8)(Src[1], &CmpBounceBufferLookaside);
}
else
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&CmpBounceBufferLookaside, (PSLIST_ENTRY)Src[1]);
}
}
else
{
CmSiFreeMemory((PPRIVILEGE_SET)Src[1]);
}
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
p_DestinationString = &DestinationString;
LOBYTE(p_DestinationString) = 16;
(*(void(__fastcall **)(struct _UNICODE_STRING *, LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, struct _UNICODE_STRING *))((char *)&NlsMbCodePageTag + 7))(
p_DestinationString,
v88,
(unsigned int)v14,
(unsigned int)v46,
DmaOperations,
&DestinationString);
}
if( Privileges && Privileges != (PPRIVILEGE_SET)v97 )
CmSiFreeMemory(Privileges);
if( v45 )
{
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v41;
}
return(unsigned int)v14;
}Referenced by:
ExpWatchProductTypeInitialization
ExpWatchProductTypeWork
InitSafeBoot
IoInitSystemPreDrivers
IopLoadDriver
IopProtectSystemPartition