NtEnumerateValueKey
NTSTATUS __stdcall NtEnumerateValueKey(
VOID *KeyHandle,
UINT64 Index,
_KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
VOID *KeyValueInformation,
UINT64 Length,
UINT64 *ResultLength){
unsigned int v8;
_ETHREAD *CurrentThread;
INT64 v11;
UINT8 v12;
INT64 v13;
unsigned int v14;
NTSTATUS v15;
_ADAPTER_OBJECT *v16;
size_t v17;
__int64 v18;
_ETHREAD *v19;
int v20;
size_t v21;
_DMA_OPERATIONS *v22;
_ETHREAD *v23;
__int64 v25;
char PreviousMode;
UINT8 v28;
char v29;
char v30;
int v31;
PADAPTER_OBJECT DmaAdapter;
__int64 v33;
_DMA_OPERATIONS *DmaOperations;
int v35;
PADAPTER_OBJECT v36;
_DMA_OPERATIONS *v37;
INT64 v38[2];
PVOID v39;
PVOID Object;
PVOID v41;
_SLIST_ENTRY *v42;
NTSTATUS v43;
int v44;
_SLIST_ENTRY **v45;
NTSTATUS v46;
__int128 v47;
__int64 v48;
int v49;
_SLIST_ENTRY *Argument[9];
_LARGE_INTEGER TimeStamp[2];
__int128 v52;
_KAPC_STATE ApcState;
VOID *Src[2];
char v55;
char v56[71];
v8 = Index;
v31 = Index;
v35 = Index;
memset(&ApcState, 0, sizeof(ApcState));
memset(v56, 0i64, sizeof(v56));
*(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
v52 = 0i64;
DmaOperations = 0i64;
v37 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
v29 = 0;
v30 = 0;
memset(Argument, 0i64, 0x40u);
DmaAdapter = 0i64;
LODWORD(v33) = 0;
*(_OWORD *)Src = 0i64;
v55 = 0;
v38[1] = (INT64)v38;
v38[0] = (INT64)v38;
v36 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v12 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
v28 = v12;
if( !v12 )
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( !v12 )
{
v15 = -1073741431;
v22 = 0i64;
goto LABEL_40;
}
if( (unsigned int)KeyValueInformationClass > KeyValuePartialInformation )
{
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7)
&& KeyHandle
&& (PreviousMode = KeGetCurrentThread()->PreviousMode,
v39 = 0i64,
ObReferenceObjectByHandle(KeyHandle, 0i64, (_OBJECT_TYPE *)CmKeyObjectType, PreviousMode, &v39, 0i64) >= 0) )
{
v22 = (_DMA_OPERATIONS *)*((_QWORD *)v39 + 1);
HalPutDmaAdapter((PADAPTER_OBJECT)v39);
}
else
{
v22 = 0i64;
}
v15 = -1073741811;
goto LABEL_40;
}
v14 = KeGetCurrentThread()->PreviousMode;
Argument[8] = 0i64;
Object = 0i64;
v15 = ObReferenceObjectByHandle(KeyHandle, 1ui64, (_OBJECT_TYPE *)CmKeyObjectType, v14, &Object, 0i64);
v16 = (_ADAPTER_OBJECT *)Object;
v41 = Object;
if( v15 >= 0 )
{
if( *(_DWORD *)Object == 1803104306 )
{
DmaAdapter = (PADAPTER_OBJECT)Object;
v16 = 0i64;
v41 = 0i64;
v15 = 0;
}
else
{
v15 = -1073741816;
}
}
if( v16 )
HalPutDmaAdapter(v16);
if( v15 < 0 )
{
v8 = v31;
v22 = 0i64;
goto LABEL_40;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter )
{
DmaOperations = DmaAdapter->AdapterObject.DmaHeader.DmaOperations;
v37 = DmaOperations;
}
if( (_BYTE)v14 == 1 )
{
v17 = Length;
if( (_DWORD)Length )
{
if( ((unsigned __int8)KeyValueInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)KeyValueInformation + (unsigned int)Length > 0x7FFFFFFF0000i64
|| (char *)KeyValueInformation + (unsigned int)Length < KeyValueInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
v11 = 0x7FFFFFFF0000i64;
}
v18 = (__int64)ResultLength;
if( (unsigned __int64)ResultLength >= 0x7FFFFFFF0000i64 )
v18 = 0x7FFFFFFF0000i64;
*(_DWORD *)v18 = *(_DWORD *)v18;
}
else
{
v17 = Length;
}
v19 = (_ETHREAD *)KeGetCurrentThread();
--v19->Tcb.KernelApcDisable;
v30 = 1;
if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v11, v13) )
{
Argument[0] = (_SLIST_ENTRY *)DmaAdapter;
Argument[1] = (_SLIST_ENTRY *)__PAIR64__(KeyValueInformationClass, v31);
Argument[2] = (_SLIST_ENTRY *)KeyValueInformation;
LODWORD(Argument[3]) = v17;
Argument[4] = (_SLIST_ENTRY *)ResultLength;
v20 = CmpCallCallBacksEx(
RegNtEnumerateValueKey,
Argument,
0i64,
1,
RegNtPostEnumerateValueKey,
(INT64)DmaAdapter,
(INT64)v38);
v15 = v20;
if( v20 < 0 )
{
v12 = v28;
v8 = v31;
v22 = DmaOperations;
if( v20 == -1073740541 )
v15 = 0;
goto LABEL_40;
}
v29 = 1;
}
v15 = CmKeyBodyRemapToVirtualForEnum((CM_KEY_BODY **)&DmaAdapter, (CM_KEY_BODY **)(unsigned __int8)v14);
if( v15 < 0
|| (v15 = CmpBounceContextStart((INT64)Src, (struct SLIST_ENTRY *)KeyValueInformation, v17, v14, 1), v15 < 0) )
{
v8 = v31;
LABEL_58:
v22 = DmaOperations;
v12 = v28;
goto LABEL_40;
}
if( v36 )
{
CmpAttachToRegistryProcess(&ApcState);
v8 = v31;
v15 = CmEnumerateValueKeyFromMergedView(
(__int64)DmaAdapter,
(__int64)v36,
0,
v31,
KeyValueInformationClass,
(_DWORD *)Src[1],
v17,
(__int64)&v33,
0i64);
KiUnstackDetachProcess(&ApcState, 0i64);
}
else
{
v8 = v31;
v15 = CmEnumerateValueKey((__int64)DmaAdapter, v31, KeyValueInformationClass, (_DWORD *)Src[1], v17, (__int64)&v33);
}
if( v15 < 0 && v15 != -2147483643 && v15 != -1073741789 )
goto LABEL_58;
v21 = v33;
*(_DWORD *)ResultLength = v33;
if( v15 != -1073741789 )
{
if( v17 >= v21 )
v17 = v21;
v11 = (INT64)Src[1];
if( Src[0] != Src[1] )
memmove(Src[0], Src[1], v17);
}
v12 = v28;
v22 = DmaOperations;
LABEL_40:
if( v36 )
HalPutDmaAdapter(v36);
if( v29
&& dword_140C5083C
&& !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v11, v13)
&& (INT64 *)v38[0] != v38 )
{
v44 = 0;
v47 = 0i64;
v48 = 0i64;
v49 = 0;
v42 = (_SLIST_ENTRY *)DmaAdapter;
v43 = v15;
v46 = v15;
v45 = Argument;
CmpCallCallBacksEx(
RegNtPostEnumerateValueKey,
&v42,
0i64,
0,
RegNtPostEnumerateValueKey,
(INT64)DmaAdapter,
(INT64)v38);
v15 = v46;
}
if( v30 )
{
v23 = (_ETHREAD *)KeGetCurrentThread();
if( v23->Tcb.KernelApcDisable++ == -1
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v23->Tcb.ApcState.ApcListHead[0].Flink != &v23->Tcb.152
&& !v23->Tcb.SpecialApcDisable )
{
KiCheckForKernelApcDelivery();
}
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
CmpBounceContextCleanup((INT64)Src);
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
LOBYTE(v25) = 18;
(*(void(__fastcall **)(__int64, _LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _QWORD))((char *)&NlsMbCodePageTag
+ 7))(
v25,
TimeStamp,
(unsigned int)v15,
v8,
v22,
0i64);
}
if( v12 )
{
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
return v15;
}Referenced by:
AdtpObjsInitialize