NtDeleteKey
NTSTATUS __stdcall NtDeleteKey(VOID *Handle){
__int64 v1;
char v3;
char v4;
char v5;
char PreviousMode;
_ETHREAD *CurrentThread;
INT8 v8;
PVOID *v9;
INT64 v10;
_DMA_OPERATIONS *v11;
NTSTATUS v12;
INT64 v13;
PADAPTER_OBJECT v14;
_ETHREAD *v15;
unsigned int(__fastcall *GetDmaAlignment)(_DMA_ADAPTER *);
INT8 v18;
PVOID *v19;
NTSTATUS v20;
int v21;
_GUID *p_TransactionId;
UINT8 v23;
PADAPTER_OBJECT DmaAdapter;
int v25;
__int64 v26;
_DMA_OPERATIONS *DmaOperations;
CM_TRANS *CmTrans;
INT64 a6[2];
_SECURITY_SUBJECT_CONTEXT SubjectContext;
_SLIST_ENTRY *Argument[2];
__int128 v32;
_GUID TransactionId;
_LARGE_INTEGER TimeStamp[2];
__int128 v35;
v1 = 0i64;
v26 = 0i64;
DmaOperations = 0i64;
v3 = 0;
v25 = 0;
*(_OWORD *)Argument = 0i64;
CmTrans = 0i64;
v32 = 0i64;
*(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
v35 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
DmaAdapter = 0i64;
a6[1] = (INT64)a6;
v4 = 0;
a6[0] = (INT64)a6;
v5 = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
PreviousMode = KeGetCurrentThread()->PreviousMode;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v23 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
if( !v23 )
{
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v12 = -1073741431;
goto LABEL_32;
}
LOBYTE(v9) = PreviousMode;
v12 = CmObReferenceObjectByHandle(Handle, 0x10000ui64, v8, v9, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
if( v12 == -1073741790 )
{
SeCaptureSubjectContext((INT64)&SubjectContext);
if( !CmDoVirtualTest(&SubjectContext, &v25) )
{
v12 = -1073741790;
v14 = DmaAdapter;
goto LABEL_40;
}
LOBYTE(v19) = PreviousMode;
v20 = CmObReferenceObjectByHandle(Handle, 0x20019ui64, v18, v19, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
v14 = DmaAdapter;
v12 = v20;
if( v20 < 0 )
goto LABEL_40;
if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter) )
{
v12 = -1073741790;
goto LABEL_40;
}
v3 = 1;
}
else
{
v14 = DmaAdapter;
}
if( v12 >= 0 )
{
v15 = (_ETHREAD *)KeGetCurrentThread();
--v15->Tcb.KernelApcDisable;
v14 = DmaAdapter;
v12 = 0;
v5 = 1;
if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v10, v13) )
{
Argument[0] = (_SLIST_ENTRY *)v14;
v12 = CmpCallCallBacksEx(RegNtDeleteKey, Argument, 0i64, 1, RegNtPostDeleteKey, (INT64)v14, (INT64)a6);
if( v12 < 0 )
{
if( v12 == -1073740541 )
v12 = 0;
goto LABEL_24;
}
v4 = 1;
v12 = 0;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && v14 )
DmaOperations = v14->AdapterObject.DmaHeader.DmaOperations;
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 40, 0i64);
if( *(&ExBootDevicesRemovedEvent + 42)
&& v14->AdapterObject.DmaHeader.DmaOperations == *(_DMA_OPERATIONS **)(*(&ExBootDevicesRemovedEvent + 42) + 8i64)
|| *(&ExBootDevicesRemovedEvent + 43)
&& v14->AdapterObject.DmaHeader.DmaOperations == *(_DMA_OPERATIONS **)(*(&ExBootDevicesRemovedEvent + 43) + 8i64) )
{
if( _InterlockedCompareExchange64((_QWORD *)&ExBootDevicesRemovedEvent + 40, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 40);
KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 320);
v14 = DmaAdapter;
}
else
{
if( _InterlockedCompareExchange64((_QWORD *)&ExBootDevicesRemovedEvent + 40, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 40);
KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 320);
v14 = DmaAdapter;
v11 = DmaAdapter->AdapterObject.DmaHeader.DmaOperations;
if( (LODWORD(v11->PutDmaAdapter) & 0x80u) != 0 )
goto LABEL_55;
GetDmaAlignment = v11->GetDmaAlignment;
if( GetDmaAlignment )
{
if( (*((_DWORD *)GetDmaAlignment + 2) & 0x80u) != 0 )
goto LABEL_55;
}
if( !v3 )
goto LABEL_22;
v21 = CmKeyBodyRemapToVirtual((__int64 *)&DmaAdapter, PreviousMode, 0x10000u, &SubjectContext, &v25);
v14 = DmaAdapter;
v12 = v21;
if( v21 < 0 )
goto LABEL_24;
if( CmpVEEnabled && ((__int64)DmaAdapter->AdapterObject.DmaHeader.DmaOperations->MapTransferEx & 0x1000000) != 0 )
{
LABEL_22:
v12 = CmDeleteKey(v14);
if( v12 >= 0 && (v26 & 4) != 0 )
{
if( v14->AdapterObject.ContiguousTranslationEnd.Buffer
|| *(_QWORD *)&v14->AdapterObject.ContiguousTranslationEnd.Offset )
{
CmpLockRegistry();
CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)v14, &CmTrans);
TransactionId = CmTrans->KtmUow;
CmpUnlockRegistry();
p_TransactionId = &TransactionId;
}
else
{
p_TransactionId = 0i64;
}
SeDeleteObjectAuditAlarmWithTransaction(v14, Handle, p_TransactionId);
}
}
else
{
LABEL_55:
v12 = -1073741790;
}
}
}
LABEL_24:
if( v3 )
LABEL_40:
SeReleaseSubjectContext(&SubjectContext);
if( v4 )
v12 = CmPostCallbackNotificationEx(
RegNtPostDeleteKey,
(_SLIST_ENTRY *)v14,
(unsigned int)v12,
(INT64)Argument,
0i64,
(INT64)a6);
if( v5 )
{
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v14 = DmaAdapter;
}
if( v14 )
HalPutDmaAdapter(v14);
v1 = (__int64)DmaOperations;
LABEL_32:
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
LOBYTE(v11) = 12;
(*(void(__fastcall **)(_DMA_OPERATIONS *, _LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag
+ 7))(
v11,
TimeStamp,
(unsigned int)v12,
0i64,
v1,
0i64);
}
if( v23 )
{
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
return v12;
}Referenced by:
No references.