NtCompressKey

NTSTATUS __stdcall NtCompressKey(PVOID Key){
  NTSTATUS v2; 
  INT8 v3; 
  INT8 v4; 
  PVOID *v5; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  PADAPTER_OBJECT v8; 
  _DMA_OPERATIONS *DmaOperations; 
  int(__fastcall *AllocateAdapterChannel)(_DMA_ADAPTER *, _DEVICE_OBJECT *, unsigned int, _IO_ALLOCATION_ACTION(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *, void *), void *); 
  _HIVE_WRITE_WAIT_QUEUE *v11; 
  UINT64 v12; 
  PADAPTER_OBJECT DmaAdapter; 
  KAPC_STATE ApcState; 
  DmaAdapter = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v2 = CmCheckNoTxContext();
  if( v2 >= 0 )
  {
    v3 = *((_BYTE *)KeGetCurrentThread() + 562);
    if( SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, v3) )
    {
      LOBYTE(v5) = v3;
      v6 = (unsigned __int8)Key & 3;
      v2 = CmObReferenceObjectByHandle(Key, 0x20006ui64, v4, v5, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
      if( v2 >= 0 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)CurrentThread + 242);
        if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown) )
        {
          v8 = DmaAdapter;
          while( 1 )
          {
            CmpLockRegistryExclusive();
            v2 = CmpPerformKeyBodyDeletionCheck((__int64)v8, 0i64);
            if( v2 < 0 )
              break;
            DmaOperations = v8->DmaOperations;
            AllocateAdapterChannel = DmaOperations->AllocateAdapterChannel;
            if( LODWORD(DmaOperations->FlushAdapterBuffers) != *(_DWORD *)(*((_QWORD *)AllocateAdapterChannel + 8)
                                                                          + 36i64) )
            {
              v2 = -1073741811;
              break;
            }
            v11 = (_HIVE_WRITE_WAIT_QUEUE *)((char *)AllocateAdapterChannel + 4248);
            if( !PoIsInitializedStopWatch((_QWORD *)AllocateAdapterChannel + 531) )
            {
              v11 = (_HIVE_WRITE_WAIT_QUEUE *)((char *)AllocateAdapterChannel + 4232);
              if( !PoIsInitializedStopWatch((_QWORD *)AllocateAdapterChannel + 529) )
              {
                CmpAttachToRegistryProcess(&ApcState);
                v2 = CmCompressKey((INT64)v8->DmaOperations->AllocateAdapterChannel, v6);
                KiUnstackDetachProcess(&ApcState, 0i64);
                break;
              }
            }
            ExAcquirePushLockExclusiveEx((UINT64)AllocateAdapterChannel + 72, 0i64);
            CmpWaitOnHiveWriteQueue((_CMHIVE *)AllocateAdapterChannel, v11, v12);
          }
          CmpUnlockRegistry();
          ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        }
        else
        {
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
          v2 = -1073741431;
        }
      }
      if( DmaAdapter )
        HalPutDmaAdapter(DmaAdapter);
    }
    else
    {
      return -1073741727;
    }
  }
  return v2;
}

Referenced by: