VrpDestroyNamespaceNode
__int64 __fastcall VrpDestroyNamespaceNode(UINT64 *a1, __int64 a2){
unsigned int v2;
UINT64 v5;
UINT64 v6;
unsigned __int64 v7;
UINT64 v8;
UINT64 v9;
void *v10;
void *v11;
void *v12;
UINT64 v14;
char *v15;
__int64 v16;
unsigned __int64 v17;
__int64 v18;
UINT64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
unsigned __int64 v22;
UINT64 v23;
VOID *v24;
VOID **PoolWithTag;
VOID **v26;
size_t v27;
_OBJECT_ATTRIBUTES ObjectAttributes;
UINT64 v29;
v29 = 0i64;
v2 = 0;
if( VrpFindExactNamespaceNode(a1, (_UNICODE_STRING *)a2, &v29) != (_UNICODE_STRING *)a2 )
goto LABEL_4;
v6 = a1[6];
v2 = 1;
v7 = v29;
if( v29 >= v6 )
goto LABEL_4;
v5 = a1[5];
v8 = v5 * v29;
v29 = 0i64;
if( !is_mul_ok(v5, v7) )
goto LABEL_4;
v14 = a1[9];
v15 = (char *)(v14 + v8);
if( v14 + v8 < v14 )
goto LABEL_4;
v16 = v6 - v7 - 1;
if( v16 )
{
v29 = 0i64;
v17 = v16;
v16 *= v5;
if( !is_mul_ok(v17, v5) )
goto LABEL_4;
v29 = 0i64;
v18 = v5 * (v7 + 1);
if( !is_mul_ok(v5, v7 + 1) || v14 + v18 < v14 )
goto LABEL_4;
memmove(v15, (const VOID *)(v14 + v18), v16);
v5 = a1[5];
}
memset(&v15[v16], 0i64, v5);
v19 = --a1[6];
if( v19 <= 0x10 )
goto LABEL_4;
v20 = a1[5];
v21 = a1[7];
if( v21 * v20 < 0x400 )
goto LABEL_4;
if( v19 >= v21 >> 2 )
goto LABEL_4;
v22 = v21 >> 1;
v29 = v21 * v20;
if( !is_mul_ok(v21, v20) )
goto LABEL_4;
v23 = v22 * v20;
if( !is_mul_ok(v22, v20) )
goto LABEL_4;
v24 = (VOID *)a1[9];
PoolWithTag = ExAllocatePoolWithTag(1ui64, v22 * v20, 1918981202i64);
v26 = PoolWithTag;
if( !v24 )
{
if( PoolWithTag )
memset(PoolWithTag, 0i64, v23);
LABEL_34:
if( v26 )
{
a1[9] = (UINT64)v26;
a1[7] = v22;
}
goto LABEL_4;
}
if( PoolWithTag )
memset(PoolWithTag, 0i64, v23);
if( v26 )
{
v27 = v29;
if( v29 >= v23 )
v27 = v23;
memmove(v26, v24, v27);
ExFreePoolWithTag(v24, 0x72615452u);
goto LABEL_34;
}
LABEL_4:
if( (*(_DWORD *)(a2 + 56) & 0xC0000000) == -1073741824 )
{
v29 = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey((VOID **)&v29, 0xF003Fui64, &ObjectAttributes, v5, 48i64, 0i64, a2 + 40, 576i64) >= 0 )
{
ZwDeleteKey((VOID *)v29);
ZwClose(v29);
}
}
v9 = *(_QWORD *)(a2 + 16);
if( v9 )
ObDereferenceObjectDeferDeleteWithTag(v9, 1734693462i64);
v10 = *(void **)(a2 + 8);
if( v10 )
ExFreePoolWithTag(v10, 0x67655256u);
v11 = *(void **)(a2 + 32);
if( v11 )
ExFreePoolWithTag(v11, 0x67655256u);
v12 = *(void **)(a2 + 48);
if( v12 )
ExFreePoolWithTag(v12, 0x67655256u);
ExFreePoolWithTag((PVOID)a2, 0x67655256u);
return v2;
}Referenced by:
VrpCleanupNamespace
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpPostUnloadKey
VrpPreLoadKey