NtCompactKeys

NTSTATUS __stdcall NtCompactKeys(UINT64 Count, VOID **KeyArray){
  unsigned int v3; 
  _PRIVILEGE_SET *TransientPoolWithQuotaTag; 
  unsigned int v5; 
  UINT8 v6; 
  NTSTATUS v7; 
  INT64 v8; 
  char v9; 
  UINT64 v10; 
  INT8 v11; 
  PVOID *v12; 
  PVOID *v13; 
  _ETHREAD *CurrentThread; 
  unsigned int v15; 
  CM_KEY_BODY **v16; 
  _CM_KEY_CONTROL_BLOCK *KeyControlBlock; 
  _HHIVE *KeyHive; 
  __int16 bf_b8_high; 
  PADAPTER_OBJECT *v20; 
  __int64 v21; 
  char Object; 
  _HHIVE *v24; 
  CM_KEY_BODY *v25; 
  char v26; 
  UINT8 v27; 

  v3 = Count;
  TransientPoolWithQuotaTag = 0i64;
  v5 = 0;
  v26 = 0;
  v6 = 0;
  v7 = CmCheckNoTxContext();
  if( v7 < 0 )
  {
LABEL_4:
    v9 = 0;
  }
  else
  {
    Object = KeGetCurrentThread()->PreviousMode;
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, Object) )
    {
      v7 = -1073741727;
      goto LABEL_4;
    }
    if( !v3 )
    {
      v7 = 0;
      goto LABEL_4;
    }
    if( v3 >= 0x1FFFFFFF )
    {
      v7 = -1073741811;
      goto LABEL_4;
    }
    v10 = 8 * v3;
    TransientPoolWithQuotaTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithQuotaTag(v8, v10, 0x61624D43ui64);
    if( !TransientPoolWithQuotaTag )
    {
      v7 = -1073741670;
      v6 = 0;
      goto LABEL_4;
    }
    if( Object == 1 && (_DWORD)v10 )
    {
      if( ((unsigned __int8)KeyArray & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)&KeyArray[v10 / 8] > 0x7FFFFFFF0000i64 || &KeyArray[v10 / 8] < KeyArray )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(TransientPoolWithQuotaTag, KeyArray, v10);
    v13 = (PVOID *)TransientPoolWithQuotaTag;
    do
    {
      LOBYTE(v12) = Object;
      v7 = CmObReferenceObjectByHandle(
             *v13,
             0x20006ui64,
             v11,
             v12,
             (OBJECT_HANDLE_INFORMATION *)TransientPoolWithQuotaTag + v5);
      if( v7 < 0 )
      {
        v6 = 0;
        v9 = 0;
        goto LABEL_44;
      }
      ++v5;
      ++v13;
    }
    while( v5 < v3 );
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v6 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    v27 = v6;
    if( !v6 )
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( v6 )
    {
      CmpLockRegistryExclusive();
      v26 = 1;
      v24 = 0i64;
      v15 = 0;
      v16 = (CM_KEY_BODY **)TransientPoolWithQuotaTag;
      while( 1 )
      {
        v25 = *v16;
        v7 = CmpPerformKeyBodyDeletionCheck(*v16, 0i64);
        if( v7 < 0 )
          goto LABEL_42;
        KeyControlBlock = v25->KeyControlBlock;
        if( v15 )
        {
          KeyHive = v24;
        }
        else
        {
          KeyHive = KeyControlBlock->KeyHash.KeyHive;
          v24 = KeyHive;
        }
        if( KeyHive != KeyControlBlock->KeyHash.KeyHive )
          break;
        bf_b8_high = HIWORD(KeyControlBlock->_bf_b8);
        if( (bf_b8_high & 4) != 0 || (bf_b8_high & 0x10) != 0 )
          break;
        if( KeyControlBlock->LayerHeight )
        {
          v7 = -1073741822;
LABEL_42:
          v6 = v27;
          goto LABEL_43;
        }
        ++v15;
        ++v16;
        if( v15 >= v3 )
        {
          v6 = v27;
          v7 = 0;
          CmpUnlockRegistry();
          CmpLogUnsupportedOperation(7);
          goto LABEL_4;
        }
      }
      v7 = -1073741811;
      goto LABEL_42;
    }
    v7 = -1073741431;
LABEL_43:
    v9 = v26;
  }
LABEL_44:
  if( v9 )
    CmpUnlockRegistry();
  if( v6 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  if( TransientPoolWithQuotaTag )
  {
    if( v5 )
    {
      v20 = (PADAPTER_OBJECT *)TransientPoolWithQuotaTag;
      v21 = v5;
      do
      {
        HalPutDmaAdapter(*v20++);
        --v21;
      }
      while( v21 );
    }
    CmSiFreeMemory(TransientPoolWithQuotaTag);
  }
  return v7;
}

Referenced by: