CmpReorganizeHive
INT64 __stdcall CmpReorganizeHive(CMHIVE *CmHive, UNICODE_STRING *FileName){
int v2;
_HBASE_BLOCK *BaseBlock;
int v5;
_HIVE_LOAD_FAILURE *v7;
unsigned int Flags;
unsigned int HiveFlags;
int v10;
_HBASE_BLOCK *v12;
unsigned int v13;
unsigned __int64 LastReorganizeTime;
unsigned __int8 *v15;
unsigned __int16 v16;
int EmptyHiveClone;
_HHIVE *v18;
unsigned int v19;
_HIVE_LOAD_FAILURE *TransientPoolWithTag;
int Index;
int RecoverableIndex;
int FailureCount;
int v24;
int v25;
unsigned int Length;
unsigned int v27;
unsigned __int64 v28;
_LARGE_INTEGER v29;
CHAR v30;
INT64 v31;
UINT64 v32;
unsigned __int64 v33;
__int16 v34;
__int16 v35;
__int16 v36;
int v37;
int v38;
int v39;
unsigned int v40;
unsigned int v41;
_HHIVE *Hive;
__int64 v43;
__int64 v44;
unsigned __int64 v45;
__int64 v46;
__int64 v47;
__int128 v48;
_EVENT_DATA_DESCRIPTOR v49;
int *v50;
__int64 v51;
__int16 *v52;
__int64 v53;
__int16 *v54;
__int64 v55;
__int16 *v56;
__int64 v57;
unsigned __int16 *p_Index;
__int64 v59;
struct {_CM_LOAD_FAILURE_TYPE Failure;int Status;unsigned int Point;} *p_Locations;
int v61;
int v62;
unsigned __int16 *p_RecoverableIndex;
__int64 v64;
struct {_CM_LOAD_FAILURE_TYPE Failure;int Status;unsigned int Point;} *p_RecoverableLocations;
int v66;
int v67;
unsigned __int8 *p_FailureCount;
__int64 v69;
struct {int Status;unsigned int Point;} *p_FailurePoints;
int v71;
int v72;
__int64 *v73;
__int64 v74;
_EVENT_DATA_DESCRIPTOR v75;
__int64 *v76;
__int64 v77;
int *v78;
__int64 v79;
int *v80;
__int64 v81;
__int64 *v82;
__int64 v83;
_EVENT_DATA_DESCRIPTOR v84;
int *v85;
__int64 v86;
int *v87;
__int64 v88;
__int64 *v89;
__int64 v90;
_EVENT_DATA_DESCRIPTOR v91;
unsigned __int64 *v92;
__int64 v93;
__int64 *v94;
__int64 v95;
BaseBlock = CmHive->Hive.BaseBlock;
Hive = 0i64;
v5 = v2;
v7 = 0i64;
Flags = BaseBlock->Flags;
v48 = 0i64;
if( (Flags & 1) != 0 )
return 0;
HiveFlags = CmHive->Hive.HiveFlags;
if( (HiveFlags & 0x10) == 0 && !CmHive->FileHandles[0] )
return 0;
if( (HiveFlags & 0x8001) != 0 || !CmHive->Hive.CurrentLog )
return 0;
if( !CmpAcquireShutdownRundown() )
{
v10 = -1073741431;
LABEL_25:
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
LODWORD(v33) = v10;
v92 = &v33;
v93 = 4i64;
v94 = &v47;
v47 = 0x1000000i64;
v95 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)&byte_140022727,
0i64,
0i64,
4u,
&v91);
}
return(unsigned int)v10;
}
if( (v5 & 0x400000) != 0 && ExIsSoftBoot() && CmHive->Hive.BaseBlock->LastReorganizeTime - 1 > 1 )
goto LABEL_12;
v12 = CmHive->Hive.BaseBlock;
v13 = KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFC;
v33 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64;
LastReorganizeTime = v12->LastReorganizeTime;
if( LastReorganizeTime <= (*(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64)
&& (*(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart & 0xFFFFFFFFFFFFFFFCui64) - LastReorganizeTime < 864000000000i64 * (unsigned __int64)(unsigned int)CmpReorganizeDelayDays )
{
goto LABEL_12;
}
if( !FileName )
{
v15 = v12->FileName;
v16 = 0;
*((_QWORD *)&v48 + 1) = v15;
do
{
if( !*(_WORD *)&v15[2 * v16] )
break;
++v16;
}
while( v16 < 0x1Fu );
FileName = (UNICODE_STRING *)&v48;
LOWORD(v48) = 2 * v16;
}
if( LastReorganizeTime == 2 || LastReorganizeTime != 1 && (CmHive->Flags & 0x400) == 0 )
{
LODWORD(v33) = v13 | 2;
CmpClearKeyAccessBits(CmHive, FileName);
CmpLockRegistry();
HvLockHiveFlusherShared((INT64)CmHive);
HvLockHiveWriter((INT64)CmHive);
HvMarkBaseBlockDirty(&CmHive->Hive);
CmHive->Hive.BaseBlock->LastReorganizeTime = v33;
HvUnlockHiveWriter((INT64)CmHive);
HvUnlockHiveFlusherShared((INT64)CmHive);
CmpUnlockRegistry();
LABEL_12:
v10 = 0;
goto LABEL_13;
}
if( CmHive->Hive.BaseBlock->RootCell == -1 )
goto LABEL_12;
LODWORD(v33) = v13 | 1;
EmptyHiveClone = CmpCreateEmptyHiveClone((INT64 *)&Hive, (INT64)CmHive);
v18 = Hive;
v10 = EmptyHiveClone;
if( EmptyHiveClone >= 0 )
{
LODWORD(v32) = 0;
v19 = CmpCopyKeyPartial((UINT64)CmHive, CmHive->Hive.BaseBlock->RootCell, (UINT64)Hive, 0xFFFFFFFFui64, 6, v30, v32);
if( v19 != -1
&& (v18->BaseBlock->RootCell = v19,
HvMarkBaseBlockDirty(v18),
LODWORD(v31) = 0,
CmpCopySyncTree((UINT64)CmHive, CmHive->Hive.BaseBlock->RootCell, (UINT64)v18, v19, 66, v31))
&& (TransientPoolWithTag = (_HIVE_LOAD_FAILURE *)CmpAllocateTransientPoolWithTag(1ui64, 0x1B0ui64),
(v7 = TransientPoolWithTag) != 0i64) )
{
memset(TransientPoolWithTag, 0i64, 0x1B0u);
v10 = CmCheckRegistry((__int64)v18, 2031616i64, v7);
if( v10 >= 0 )
{
if( (CmHive->Hive.BaseBlock->BootType & 4) != 0
|| CmHive->LoadedKeyCount == v18[3].LastLogSwapTime.anonymous_0.HighPart )
{
v18->HiveLoadFailure = 0i64;
Length = v18->Storage[0].Length;
v27 = CmHive->Hive.Storage[0].Length;
CmpSwapHiveStorage((INT64)CmHive, (INT64)v18);
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v28 = CmHive->Hive.BaseBlock->LastReorganizeTime;
v76 = (__int64 *)&v45;
v78 = (int *)&v40;
v80 = (int *)&v41;
v82 = &v46;
v45 = v28;
v77 = 8i64;
v40 = v27;
v79 = 4i64;
v41 = Length;
v81 = 4i64;
v46 = 0x1000000i64;
v83 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)byte_1400227D1,
0i64,
0i64,
6u,
&v75);
}
CmpLockRegistry();
HvLockHiveFlusherShared((INT64)CmHive);
HvLockHiveWriter((INT64)CmHive);
HvMarkBaseBlockDirty(&CmHive->Hive);
v29.QuadPart = v33;
CmHive->Hive.BaseBlock->LastReorganizeTime = v33;
HvUnlockHiveWriter((INT64)CmHive);
HvUnlockHiveFlusherShared((INT64)CmHive);
CmpUnlockRegistry();
CmpLogReorganizeEvent(&FileName->Length, v27, Length);
if( Length < v27 )
{
if( CmpFirstReorganize )
{
*(&stru_140CF2E80 + 935) = 0i64;
CmpReorganizeLastRun = v29;
CmpFirstReorganize = 0;
}
*(&stru_140CF2E80 + 935) += v27 - Length;
CmpUpdateReorganizeRegistryValues();
}
v10 = 0;
}
else
{
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v38 = v24;
v85 = &v38;
v86 = 4i64;
v87 = &v39;
v39 = v25;
v89 = &v44;
v88 = 4i64;
v44 = 0x1000000i64;
v90 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)byte_140022769,
0i64,
0i64,
5u,
&v84);
}
CmpLockRegistry();
HvLockHiveFlusherShared((INT64)CmHive);
HvLockHiveWriter((INT64)CmHive);
HvMarkBaseBlockDirty(&CmHive->Hive);
CmHive->Hive.BaseBlock->LastReorganizeTime = v33;
HvUnlockHiveWriter((INT64)CmHive);
HvUnlockHiveFlusherShared((INT64)CmHive);
CmpUnlockRegistry();
v10 = -1073741492;
}
}
else
{
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v37 = v10;
v50 = &v37;
v52 = &v34;
Index = v7->Index;
RecoverableIndex = v7->RecoverableIndex;
p_Index = &v7->Index;
v54 = &v35;
p_Locations = &v7->Locations;
FailureCount = v7->LinkDebug.FailureCount;
v61 = 12 * Index;
p_RecoverableLocations = &v7->RecoverableLocations;
v66 = 12 * RecoverableIndex;
p_FailurePoints = &v7->LinkDebug.FailurePoints;
v73 = &v43;
v36 = FailureCount;
v34 = Index;
v35 = RecoverableIndex;
p_RecoverableIndex = &v7->RecoverableIndex;
p_FailureCount = &v7->LinkDebug.FailureCount;
v51 = 4i64;
v53 = 2i64;
v55 = 2i64;
v56 = &v36;
v57 = 2i64;
v59 = 2i64;
v62 = 0;
v64 = 2i64;
v67 = 0;
v69 = 2i64;
v71 = 8 * FailureCount;
v72 = 0;
v43 = 0x1000000i64;
v74 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)&byte_140022827,
0i64,
0i64,
0xDu,
&v49);
}
if( v10 == -1073741492 || v10 == -2147483606 )
{
CmpLockRegistry();
HvLockHiveFlusherShared((INT64)CmHive);
HvLockHiveWriter((INT64)CmHive);
HvMarkBaseBlockDirty(&CmHive->Hive);
CmHive->Hive.BaseBlock->LastReorganizeTime = v33;
HvUnlockHiveWriter((INT64)CmHive);
HvUnlockHiveFlusherShared((INT64)CmHive);
CmpUnlockRegistry();
}
}
}
else
{
v10 = -1073741670;
}
}
if( v18 )
CmpDestroyHive(v18);
LABEL_13:
CmpReleaseShutdownRundown();
if( v7 )
CmSiFreeMemory((PPRIVILEGE_SET)v7);
if( v10 < 0 )
goto LABEL_25;
return(unsigned int)v10;
}Referenced by:
CmpCreateHive