CmDeleteValueKey
NTSTATUS __stdcall CmDeleteValueKey(CM_KEY_BODY *KeyBody, UNICODE_STRING *ValueName, LIST_ENTRY *KeyHandle, INT8 Audit){
CM_KEY_BODY *v4;
INT64 KeyControlBlock;
_CM_KEY_NODE *v6;
INT64 KcbAtLayerHeight;
char v8;
_LARGE_INTEGER v9;
NTSTATUS started;
CM_TRANS *v11;
_BYTE *v12;
INT16 v13;
__int64 v14;
__int64 v15;
unsigned int v16;
char v17;
_CM_KCB_UOW *v18;
char v19;
VOID *v20;
INT64 v22;
__int64 v23;
INT64 v24;
CM_TRANS *v25;
void(__fastcall **v26)(_QWORD, _QWORD);
void *v27;
__int64 v28;
unsigned int List;
_CM_KCB_UOW *UnitOfWork;
CM_KCB_UOW *v31;
__int64 v32;
__int64 v33;
__int64 v34;
__int64 v35;
UINT8 v36;
_UNICODE_STRING *v37;
unsigned int Length;
ULONG_PTR v39;
PVOID Object;
_CM_KCB_UOW *BugCheckParameter4;
UINT8 ValueListDuplicated;
INT8 v43;
UINT64 v44;
INT64 v45;
__int64 v46;
PVOID CellIndex;
CM_TRANS *CmTrans;
__int64 v49;
INT64 v50[2];
__int128 v51;
__int64 v52;
VOID **v53;
PVOID v54;
_UNICODE_STRING *ValueNamea;
LIST_ENTRY DeferredPostAsync;
PVOID SecurityDescriptor;
PVOID HandleId;
INT64 a2[2];
_SE_CM_VALUE_AUDIT ValueChangeInfo[4];
__int128 v61;
_KAPC_STATE ApcState;
v54 = KeyBody;
v4 = KeyBody;
v44 = 0xFFFFFFFF00000000ui64;
DeferredPostAsync.Blink = &DeferredPostAsync;
KeyControlBlock = 0i64;
v53 = 0i64;
DeferredPostAsync.Flink = &DeferredPostAsync;
v6 = 0i64;
BugCheckParameter4 = 0i64;
v43 = Audit;
v49 = 0xFFFFFFFFi64;
KcbAtLayerHeight = 0i64;
v52 = 0xFFFFFFFFi64;
v46 = 0xFFFFFFFFi64;
*(_OWORD *)v50 = 0i64;
WORD1(v50[0]) = -1;
CellIndex = (PVOID)0xFFFFFFFFi64;
HandleId = KeyHandle;
ValueNamea = ValueName;
memset(&ApcState, 0, sizeof(ApcState));
ValueListDuplicated = 0;
CmTrans = 0i64;
*(_OWORD *)a2 = 0i64;
v45 = 0i64;
v51 = 0i64;
CmpInitializeDelayDerefContext(a2);
SecurityDescriptor = 0i64;
*(_OWORD *)ValueChangeInfo = 0i64;
v61 = 0i64;
CmpAttachToRegistryProcess(&ApcState);
LABEL_2:
v8 = 1;
if( (*(&CmpDummyThreadEvent + 1056) & 1) != 0 )
{
started = -1073741431;
v19 = 0;
v8 = 0;
LABEL_89:
v17 = 0;
v18 = BugCheckParameter4;
goto LABEL_27;
}
v9 = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
CmpLockRegistry();
KeyControlBlock = (INT64)v4->KeyControlBlock;
if( (*(_DWORD *)(*(_QWORD *)(KeyControlBlock + 32) + 160i64) & 0x100000) != 0 )
{
started = -1073741790;
LABEL_116:
v8 = 0;
LABEL_24:
v17 = 0;
LABEL_25:
v18 = BugCheckParameter4;
goto LABEL_26;
}
started = CmpStartKcbStackForTopLayerKcb((INT64)v50, KeyControlBlock);
if( started < 0 )
goto LABEL_116;
CmpLockKcbStackTopExclusiveRestShared((INT64)v50);
if( *(_QWORD *)&v4->Trans.0 || v4->KtmUow )
{
if( CmpIsKeyDeletedForKeyBody(v4, 0i64) )
{
v17 = 0;
started = (*((_BYTE *)v4 + 48) & 1) != 0 ? -1073740763 : -1073741444;
}
else
{
started = CmpTransSearchAddTransFromKeyBody(v4, &CmTrans);
if( started >= 0 )
{
if( (*(_DWORD *)(*(_QWORD *)(KeyControlBlock + 32) + 160i64) & 2) == 0 )
goto LABEL_7;
started = -1072103423;
}
v17 = 0;
}
v18 = BugCheckParameter4;
v19 = 1;
goto LABEL_27;
}
while( 1 )
{
LABEL_7:
v11 = CmTrans;
v12 = v54;
if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)v54, CmTrans) )
{
v17 = 0;
v8 = 1;
started = (v12[48] & 1) != 0 ? -1073740763 : -1073741444;
goto LABEL_25;
}
if( v11 )
{
UnitOfWork = CmpAllocateUnitOfWork();
BugCheckParameter4 = UnitOfWork;
v31 = UnitOfWork;
if( !UnitOfWork )
{
v19 = 1;
started = -1073741670;
v17 = 0;
v8 = 1;
goto LABEL_29;
}
CmpTransEnlistUowInKcb((_CM_KCB_UOW *__ptr32)UnitOfWork, (_CM_KEY_CONTROL_BLOCK *__ptr32)KeyControlBlock);
started = CmpTransEnlistUowInCmTrans(v31, v11);
if( started < 0 )
goto LABEL_23;
v8 = 1;
if( !CmpLockIXLockIntent((UINT64 *)(KeyControlBlock + 248), (INT64)v31)
|| !CmpLockIXLockExclusive(KeyControlBlock + 264, (INT64)v31, 1i64) )
{
started = -1072103423;
goto LABEL_24;
}
HvLockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
v17 = 1;
if( !(unsigned __int8)CmpCloneKCBValueListForTrans(
(_CM_KEY_CONTROL_BLOCK *)KeyControlBlock,
v11,
&ValueListDuplicated) )
{
started = -1073741670;
goto LABEL_25;
}
HvUnlockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
KcbAtLayerHeight = v45;
goto LABEL_11;
}
if( *(int *)(KeyControlBlock + 248) < 0 )
{
started = CmpSnapshotTxOwnerArray(KeyControlBlock + 248, &v44, &v53);
if( started < 0 )
{
LABEL_23:
v8 = 1;
goto LABEL_24;
}
CmpLogTransactionAborted(KeyControlBlock, 1, v34, (unsigned int)v44);
CmpUnlockKcbStack((INT64)v50);
v8 = 0;
CmpCleanupKcbStack((INT64)v50);
*(_OWORD *)v50 = 0i64;
WORD1(v50[0]) = -1;
v51 = 0i64;
CmpUnlockRegistry();
v19 = 0;
started = CmpRollbackTransactionArray(v44, (PADAPTER_OBJECT *)v53, v35, (_DWORD *)&CellIndex + 1);
if( started < 0 )
goto LABEL_89;
goto LABEL_87;
}
if( *(_DWORD *)(KeyControlBlock + 264) )
{
started = CmpSnapshotTxOwnerArray(KeyControlBlock + 264, &v44, &v53);
if( started < 0 )
goto LABEL_23;
CmpLogTransactionAborted(KeyControlBlock, 1, v32, (unsigned int)v44);
CmpUnlockKcbStack((INT64)v50);
v8 = 0;
CmpCleanupKcbStack((INT64)v50);
*(_OWORD *)v50 = 0i64;
WORD1(v50[0]) = -1;
v51 = 0i64;
CmpUnlockRegistry();
started = CmpRollbackTransactionArray(v44, (PADAPTER_OBJECT *)v53, v33, (_DWORD *)&CellIndex + 1);
if( started < 0 )
{
v17 = 0;
v19 = 0;
v18 = BugCheckParameter4;
goto LABEL_27;
}
LABEL_87:
v4 = (CM_KEY_BODY *)v54;
goto LABEL_2;
}
LABEL_11:
v13 = *(_WORD *)(KeyControlBlock + 66);
if( v13 < 0 )
goto LABEL_21;
while( 1 )
{
KcbAtLayerHeight = CmpGetKcbAtLayerHeight((INT64)v50, v13);
if( (unsigned int)CmpGetEffectiveKcbSemantics(KcbAtLayerHeight) == 1 )
{
LABEL_20:
KcbAtLayerHeight = v45;
goto LABEL_21;
}
v14 = *(unsigned int *)(KcbAtLayerHeight + 40);
if( (_DWORD)v14 != -1 )
break;
LABEL_19:
if( --v13 < 0 )
goto LABEL_20;
}
if( v11 && *(CM_TRANS **)(KcbAtLayerHeight + 288) == v11 )
{
started = CmpFindNameInListWithStatus(
*(_HHIVE **)(KcbAtLayerHeight + 32),
(_CHILD_LIST *)(KcbAtLayerHeight + 280),
ValueNamea,
0,
(unsigned int *)&v44 + 1,
(unsigned int *)&CellIndex);
}
else
{
v15 = (*(__int64(__fastcall **)(_QWORD, __int64, __int64 *))(*(_QWORD *)(KcbAtLayerHeight + 32) + 8i64))(
*(_QWORD *)(KcbAtLayerHeight + 32),
v14,
&v52);
started = CmpFindNameInListWithStatus(
*(_HHIVE **)(KcbAtLayerHeight + 32),
(_CHILD_LIST *)(v15 + 36),
ValueNamea,
0,
(unsigned int *)&v44 + 1,
(unsigned int *)&CellIndex);
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(KcbAtLayerHeight + 32) + 16i64))(
*(_QWORD *)(KcbAtLayerHeight + 32),
&v52);
}
if( started < 0 )
{
if( started != -1073741772 )
goto LABEL_23;
if( (unsigned int)CmpGetEffectiveKcbSemantics(KcbAtLayerHeight) )
goto LABEL_20;
goto LABEL_19;
}
v45 = KcbAtLayerHeight;
LABEL_21:
v16 = (unsigned int)CellIndex;
if( (_DWORD)CellIndex == -1 )
{
started = -1073741772;
goto LABEL_23;
}
v22 = (*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(KcbAtLayerHeight + 32) + 8i64))(
*(_QWORD *)(KcbAtLayerHeight + 32),
(unsigned int)CellIndex,
&v46);
if( CmpIsValueTombstone(*(_QWORD *)(KcbAtLayerHeight + 32), v22) )
{
started = -1073741772;
v17 = 0;
goto LABEL_107;
}
(*(void(__fastcall **)(__int64, __int64 *))(v23 + 16))(v23, &v46);
v22 = 0i64;
if( *(_DWORD *)(KeyControlBlock + 40) != -1 )
break;
CmpUnlockKcbStack((INT64)v50);
v8 = 0;
started = CmpPromoteKey((__int64)v50, 0, 1);
if( started < 0 )
{
v17 = 0;
goto LABEL_25;
}
}
v24 = *(_QWORD *)(KeyControlBlock + 32);
++*(_QWORD *)(KeyControlBlock + 304);
HvLockHiveFlusherShared(v24);
v25 = CmTrans;
v17 = 1;
if( !CmTrans && !HvMarkCellDirty(*(PVOID *)(KeyControlBlock + 32), (PVOID)*(unsigned int *)(KeyControlBlock + 40), 0) )
{
started = -1073741443;
v8 = 1;
goto LABEL_25;
}
v6 = (_CM_KEY_NODE *)(*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(KeyControlBlock + 32) + 8i64))(
*(_QWORD *)(KeyControlBlock + 32),
*(unsigned int *)(KeyControlBlock + 40),
&v49);
CmpUpdateKeyNodeAccessBits(*(_HHIVE **)(KeyControlBlock + 32), v6, *(unsigned int *)(KeyControlBlock + 40));
if( !v43 )
goto LABEL_50;
started = CmpSnapshotKcbStackSecurity((__int64)v50, (__int64)v25, 843140419i64, &SecurityDescriptor);
if( started < 0 )
goto LABEL_95;
started = CmpGetValueForAudit(*(_QWORD *)(v45 + 32), v16, (__int64)ValueChangeInfo, 0x31414D43u);
if( started < 0 )
goto LABEL_95;
v25 = CmTrans;
LABEL_50:
v26 = *(void(__fastcall ***)(_QWORD, _QWORD))(KeyControlBlock + 32);
if( v25 )
{
((void(__fastcall **)(_QWORD, __int64 *))v26)[2](v26, &v49);
v6 = 0i64;
HvUnlockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
v17 = 0;
v18 = BugCheckParameter4;
BugCheckParameter4->VolatileKeyCell = v16;
v8 = 1;
BugCheckParameter4->ActionType = UoWDeleteValue;
started = CmAddLogForAction(BugCheckParameter4);
if( started < 0 )
goto LABEL_26;
HvLockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
CmpRemoveValueFromList(*(PVOID *)(KeyControlBlock + 32), HIDWORD(v44), (unsigned int *)(KeyControlBlock + 280));
goto LABEL_59;
}
v27 = (void *)*(unsigned int *)(KeyControlBlock + 40);
if( *(_WORD *)(KeyControlBlock + 66) )
{
v36 = HvMarkCellDirty(v26, v27, 0);
if( KeyControlBlock == v45 )
{
if( v36 && HvMarkCellDirty(*(PVOID *)(KeyControlBlock + 32), (PVOID)v16, 0) )
{
v22 = (*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(KeyControlBlock + 32) + 8i64))(
*(_QWORD *)(KeyControlBlock + 32),
v16,
&v46);
if( CmpMarkValueDataDirty(*(PVOID *)(KeyControlBlock + 32), v22) )
{
CmpFreeValueData(*(_QWORD *)(KeyControlBlock + 32), *(unsigned int *)(v22 + 8), *(unsigned int *)(v22 + 4));
*(_DWORD *)(v22 + 8) = -1;
*(_WORD *)(v22 + 16) |= 2u;
*(_DWORD *)(v22 + 12) = 0;
*(_DWORD *)(v22 + 4) = 0;
v6->LastWriteTime = v9;
*(_LARGE_INTEGER *)(KeyControlBlock + 168) = v9;
goto LABEL_58;
}
goto LABEL_96;
}
goto LABEL_94;
}
if( !v36 )
{
LABEL_94:
started = -1073741443;
LABEL_95:
v18 = BugCheckParameter4;
goto LABEL_62;
}
v37 = ValueNamea;
LODWORD(Object) = *(_DWORD *)(KeyControlBlock + 40) >> 31;
started = CmpSetValueKeyTombstone(
*(_QWORD *)(KeyControlBlock + 32),
(INT64)v6,
ValueNamea,
v6->ValueList.Count,
(UINT64)Object);
if( started < 0 )
goto LABEL_95;
v6->LastWriteTime = v9;
*(_LARGE_INTEGER *)(KeyControlBlock + 168) = v9;
Length = v37->Length;
if( v6->MaxValueNameLen < Length )
{
v6->MaxValueNameLen = Length;
*(_WORD *)(KeyControlBlock + 178) = v37->Length;
}
LABEL_58:
CmpCleanUpKcbCachedSymlink(KeyControlBlock, (INT64)a2);
List = v6->ValueList.List;
*(_DWORD *)(KeyControlBlock + 96) = v6->ValueList.Count;
*(_DWORD *)(KeyControlBlock + 100) = List;
LABEL_59:
HvUnlockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
started = 0;
v17 = 0;
ValueListDuplicated = 0;
v18 = 0i64;
CmpReportNotifyForKcbStack((INT64)v50, (INT64)CmTrans, 4i64, &DeferredPostAsync);
goto LABEL_60;
}
if( !HvMarkCellDirty(v26, v27, 0)
|| !HvMarkCellDirty(*(PVOID *)(KeyControlBlock + 32), (PVOID)v6->ValueList.List, 0)
|| !HvMarkCellDirty(*(PVOID *)(KeyControlBlock + 32), (PVOID)v16, 0) )
{
goto LABEL_94;
}
v28 = v45;
v22 = (*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(v45 + 32) + 8i64))(
*(_QWORD *)(v45 + 32),
v16,
&v46);
if( CmpMarkValueDataDirty(*(PVOID *)(v28 + 32), v22) )
{
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v28 + 32) + 16i64))(*(_QWORD *)(v28 + 32), &v46);
v22 = 0i64;
CmpRemoveValueFromList(*(PVOID *)(KeyControlBlock + 32), HIDWORD(v44), (unsigned int *)&v6->ValueList);
CmpFreeValue(*(_QWORD *)(KeyControlBlock + 32), v16);
v6->LastWriteTime = v9;
*(_LARGE_INTEGER *)(KeyControlBlock + 168) = v9;
if( !v6->ValueList.Count )
{
v6->MaxValueNameLen = 0;
*(_WORD *)(KeyControlBlock + 178) = 0;
v6->MaxValueDataLen = 0;
*(_DWORD *)(KeyControlBlock + 180) = 0;
}
goto LABEL_58;
}
LABEL_96:
started = -1073741443;
LABEL_107:
v18 = BugCheckParameter4;
LABEL_60:
if( v22 )
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v45 + 32) + 16i64))(*(_QWORD *)(v45 + 32), &v46);
LABEL_62:
v8 = 1;
if( v6 )
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(KeyControlBlock + 32) + 16i64))(
*(_QWORD *)(KeyControlBlock + 32),
&v49);
LABEL_26:
v19 = 1;
LABEL_27:
if( v18 )
{
CmpRundownUnitOfWork(v18);
CmpFreeUnitOfWork(v18);
}
LABEL_29:
if( ValueListDuplicated )
{
v39 = *(_DWORD *)(KeyControlBlock + 284);
if( v39 != -1 )
HvFreeCell(*(_QWORD *)(KeyControlBlock + 32), v39);
*(_DWORD *)(KeyControlBlock + 284) = -1;
*(_DWORD *)(KeyControlBlock + 280) = 0;
*(_QWORD *)(KeyControlBlock + 288) = 0i64;
}
if( v17 )
HvUnlockHiveFlusherShared(*(_QWORD *)(KeyControlBlock + 32));
if( v8 )
CmpUnlockKcbStack((INT64)v50);
CmpDrainDelayDerefContext((UINT64 **)a2);
if( v19 )
CmpUnlockRegistry();
if( DeferredPostAsync.Flink != &DeferredPostAsync )
CmpSignalDeferredPosts(&DeferredPostAsync);
CmpDetachFromRegistryProcess(&ApcState);
v20 = SecurityDescriptor;
if( started >= 0 && v43 && SecurityDescriptor )
SeAdtRegistryValueChangedAuditAlarm(
0i64,
SecurityDescriptor,
0i64,
ValueNamea,
v54,
HandleId,
ValueChangeInfo,
AuditDeleteRegValue);
if( *(_QWORD *)&ValueChangeInfo[2] )
CmpFreeTransientPoolWithTag(*(VOID **)&ValueChangeInfo[2], 0x34414D43ui64);
if( v20 )
CmpFreeTransientPoolWithTag(v20, 0x33414D43ui64);
CmpCleanupKcbStack((INT64)v50);
return started;
}Referenced by:
NtDeleteValueKey