NtQueryValueKey
NTSTATUS __stdcall NtQueryValueKey(
VOID *KeyHandle,
_UNICODE_STRING *ValueName,
_KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
VOID *KeyValueInformation,
UINT64 Length,
UINT64 *ResultLength){
size_t v10;
_ETHREAD *CurrentThread;
unsigned __int64 v12;
UINT8 v13;
__int64 v14;
unsigned __int8 v15;
int v16;
INT64 v17;
_DMA_OPERATIONS *DmaOperations;
int v19;
wchar_t *Buffer;
UINT64 v21;
const VOID *v22;
_ETHREAD *v23;
NTSTATUS IsResourceAcquiredSharedLite;
_DWORD *v25;
int v26;
INT64 v27;
int v28;
size_t v29;
_ETHREAD *v30;
bool v31;
PSLIST_ENTRY v33;
VOID *TransientPoolWithQuotaTag;
VOID *v35;
char PreviousMode;
unsigned int v37;
char v38;
int ValueKey;
_UNICODE_STRING *p_DestinationString;
NTSTATUS v41;
char v42;
char v43;
char v44;
UINT8 v45;
_KEY_VALUE_INFORMATION_CLASS v46;
_UNICODE_STRING DestinationString;
_DMA_OPERATIONS *v48;
size_t Size;
PADAPTER_OBJECT DmaAdapter;
PPRIVILEGE_SET Privileges;
_KEY_VALUE_INFORMATION_CLASS v52;
INT64 a1;
_DMA_OPERATIONS *v54;
PADAPTER_OBJECT v55;
INT64 v56[2];
PVOID v57;
PVOID Object;
PVOID v59;
__int64 v60;
__int64 v61;
_UNICODE_STRING v62;
_SLIST_ENTRY *Argument[2];
__int128 v64;
__int128 v65;
__int128 v66;
__int64 v67;
_SLIST_ENTRY *v68;
int v69;
int v70;
_SLIST_ENTRY **v71;
int v72;
__int128 v73;
__int64 v74;
int v75;
__int64 v76;
_UNICODE_STRING v77;
_UNICODE_STRING v78;
VOID *Src[2];
char v80;
__int128 v81[4];
int v82;
__int16 v83;
char v84;
_LARGE_INTEGER TimeStamp[2];
__int128 v86;
_EVENT_DATA_DESCRIPTOR v87;
__int64 *v88;
__int64 v89;
char *v90;
__int64 v91;
__int64 *v92;
__int64 v93;
char v94[64];
v46 = KeyValueInformationClass;
v10 = Length;
v52 = KeyValueInformationClass;
a1 = (INT64)ResultLength;
DestinationString = 0i64;
memset(v81, 0, sizeof(v81));
v82 = 0;
v83 = 0;
v84 = 0;
*(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
v86 = 0i64;
v48 = 0i64;
v54 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
v42 = 0;
v43 = 0;
DmaAdapter = 0i64;
Size = 0;
RtlInitUnicodeString(&DestinationString, 0i64);
Privileges = 0i64;
*(_OWORD *)Argument = 0i64;
v64 = 0i64;
v65 = 0i64;
v66 = 0i64;
v67 = 0i64;
*(_OWORD *)Src = 0i64;
v80 = 0;
v56[1] = (INT64)v56;
v56[0] = (INT64)v56;
v55 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v13 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
if( !v13 )
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v45 = v13;
if( !v13 )
{
v16 = -1073741431;
v41 = -1073741431;
goto LABEL_119;
}
if( (unsigned int)KeyValueInformationClass > KeyValuePartialInformationAlign64 )
{
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7)
&& KeyHandle
&& (PreviousMode = KeGetCurrentThread()->PreviousMode,
v57 = 0i64,
ObReferenceObjectByHandle(KeyHandle, 0i64, (_OBJECT_TYPE *)CmKeyObjectType, PreviousMode, &v57, 0i64) >= 0) )
{
DmaOperations = (_DMA_OPERATIONS *)*((_QWORD *)v57 + 1);
HalPutDmaAdapter((PADAPTER_OBJECT)v57);
}
else
{
DmaOperations = 0i64;
}
v16 = -1073741811;
v41 = -1073741811;
goto LABEL_79;
}
v15 = KeGetCurrentThread()->$87BC921A506A176A34DE473FC146A343::gap0[10];
v76 = 0i64;
Object = 0i64;
v16 = ObReferenceObjectByHandle(KeyHandle, 1ui64, (_OBJECT_TYPE *)CmKeyObjectType, v15, &Object, 0i64);
v17 = (INT64)Object;
v59 = Object;
if( v16 >= 0 )
{
if( *(_DWORD *)Object == 1803104306 )
{
DmaAdapter = (PADAPTER_OBJECT)Object;
v17 = 0i64;
v59 = 0i64;
v16 = 0;
}
else
{
v16 = -1073741816;
}
}
if( v17 )
HalPutDmaAdapter((PADAPTER_OBJECT)v17);
v41 = v16;
if( v16 < 0 )
{
LABEL_119:
DmaOperations = 0i64;
goto LABEL_79;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && (v17 = (INT64)DmaAdapter) != 0 )
{
DmaOperations = DmaAdapter->AdapterObject.DmaHeader.DmaOperations;
v48 = DmaOperations;
v54 = DmaOperations;
}
else
{
DmaOperations = 0i64;
}
if( v15 == 1 )
{
v62 = 0i64;
v14 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
ValueName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
v19 = *(_DWORD *)&ValueName->Length;
*(_DWORD *)&v62.Length = v19;
Buffer = ValueName->Buffer;
v62.Buffer = Buffer;
DestinationString = v62;
if( (_WORD)v19 )
{
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v12 = (unsigned __int64)Buffer + (unsigned __int16)v19;
if( v12 > 0x7FFFFFFF0000i64 || v12 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (_DWORD)Length )
{
if( ((unsigned __int8)KeyValueInformation & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)KeyValueInformation + (unsigned int)Length > 0x7FFFFFFF0000i64
|| (char *)KeyValueInformation + (unsigned int)Length < KeyValueInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v17 = a1;
if( (unsigned __int64)a1 >= 0x7FFFFFFF0000i64 )
v17 = 0x7FFFFFFF0000i64;
*(_DWORD *)v17 = *(_DWORD *)v17;
}
else
{
DestinationString = *ValueName;
}
v21 = DestinationString.Length;
DestinationString.MaximumLength = DestinationString.Length;
v22 = DestinationString.Buffer;
if( v15 || *(&CmpDummyThreadEvent + 5) && !CmpIsBufferGloballyVisible(DestinationString.Buffer) )
{
if( (_WORD)v21 )
{
if( (unsigned int)v21 > 0x40 )
{
Privileges = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithQuotaTag(v17, v21, 0x6E764D43ui64);
if( !Privileges )
{
v16 = -1073741670;
v41 = -1073741670;
goto LABEL_79;
}
v22 = DestinationString.Buffer;
LOWORD(v21) = DestinationString.Length;
}
else
{
Privileges = (PPRIVILEGE_SET)v94;
}
if( Privileges )
{
memmove(Privileges, v22, (unsigned __int16)v21);
LOWORD(v21) = DestinationString.Length;
}
}
else
{
Privileges = 0i64;
}
v22 = Privileges;
DestinationString.Buffer = (wchar_t *)Privileges;
}
if( (DestinationString.Length & 1) != 0 )
{
v16 = -1073741811;
v41 = -1073741811;
goto LABEL_79;
}
while( (_WORD)v21 && !*((_WORD *)v22 + ((unsigned __int64)(unsigned __int16)v21 >> 1) - 1) )
{
LOWORD(v21) = v21 - 2;
DestinationString.Length = v21;
}
v23 = (_ETHREAD *)KeGetCurrentThread();
--v23->Tcb.KernelApcDisable;
v43 = 1;
if( !dword_140C5083C )
{
v25 = (_DWORD *)a1;
LABEL_58:
v16 = CmKeyBodyRemapToVirtualForEnum((CM_KEY_BODY **)&DmaAdapter, (CM_KEY_BODY **)v15);
v41 = v16;
if( v16 < 0 )
goto LABEL_72;
Src[0] = KeyValueInformation;
if( (_DWORD)Length )
{
if( *(&CmpDummyThreadEvent + 5) && (v15 || !CmpIsBufferGloballyVisible(KeyValueInformation)) )
{
if( *(&stru_140C00F40 + 1148) > 5u
&& (*(&stru_140C00F40 + 4608) & 4) != 0
&& (*(&stru_140C00F40 + 4616) & 4) == *(&stru_140C00F40 + 577) )
{
v60 = 1i64;
v88 = &v60;
v89 = 8i64;
v44 = 3;
v90 = &v44;
v91 = 1i64;
v37 = Length;
if( (((_DWORD)Length - 1) & (unsigned int)Length) != 0 )
{
v38 = -1;
do
{
++v38;
v37 >>= 1;
}
while( v37 );
v37 = 1 << (v38 + 1);
}
v61 = v37;
v92 = &v61;
v93 = 8i64;
tlgWriteAgg((__int64)&stru_140C00F40 + 4592, (unsigned __int8 *)&byte_14002258B, v14, 5u, &v87);
}
if( (unsigned int)Length > 0x40ui64 )
{
if( (unsigned int)Length > 0x1000ui64 )
goto LABEL_115;
++*(&WheapErrorSourceTable + 399);
v33 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)((char *)&WheapErrorSourceTable + 1576));
if( !v33 )
{
++*(&WheapErrorSourceTable + 400);
v33 = (PSLIST_ENTRY)(*(&WheapErrorSourceTable + 203))(
*(&WheapErrorSourceTable + 403),
*(&WheapErrorSourceTable + 405),
*(&WheapErrorSourceTable + 404),
(char *)&WheapErrorSourceTable + 1576);
}
if( v33 )
{
memset(v33, 0i64, Length);
v80 |= 1u;
Src[1] = v33;
}
else
{
LABEL_115:
TransientPoolWithQuotaTag = CmpAllocateTransientPoolWithQuotaTag(v27, (unsigned int)Length, 0x42424D43ui64);
v35 = TransientPoolWithQuotaTag;
if( !TransientPoolWithQuotaTag )
{
v16 = -1073741670;
goto LABEL_67;
}
memset(TransientPoolWithQuotaTag, 0i64, Length);
Src[1] = v35;
}
}
else
{
memset(v81, 0i64, Length);
Src[1] = v81;
}
}
else
{
Src[1] = KeyValueInformation;
}
}
else
{
Src[1] = 0i64;
}
v16 = 0;
LABEL_67:
v41 = v16;
if( v16 >= 0 )
{
if( !v55 )
goto LABEL_69;
v77 = DestinationString;
ValueKey = CmQueryValueKey((_DWORD)v55, (unsigned int)&v77, v46, Src[1], Length, (__int64)&Size);
v16 = ValueKey;
v41 = ValueKey;
if( ValueKey >= 0 || ValueKey == -1073741789 || ValueKey == -2147483643 )
{
LABEL_73:
v29 = Size;
*v25 = Size;
if( v16 != -1073741789 )
{
if( v29 < (unsigned int)Length )
v10 = v29;
if( Src[0] != Src[1] )
memmove(Src[0], Src[1], v10);
}
DmaOperations = v48;
goto LABEL_79;
}
if( ValueKey == -1073741772 )
{
LABEL_69:
v78 = DestinationString;
v28 = CmQueryValueKey((_DWORD)DmaAdapter, (unsigned int)&v78, v46, Src[1], Length, (__int64)&Size);
v16 = v28;
v41 = v28;
if( v28 < 0 && v28 != -2147483643 && v28 != -1073741789 )
goto LABEL_72;
goto LABEL_73;
}
}
LABEL_72:
DmaOperations = v48;
goto LABEL_79;
}
IsResourceAcquiredSharedLite = ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v12, v14);
v25 = (_DWORD *)a1;
if( IsResourceAcquiredSharedLite )
goto LABEL_58;
Argument[0] = (_SLIST_ENTRY *)DmaAdapter;
Argument[1] = (_SLIST_ENTRY *)&DestinationString;
LODWORD(v64) = v46;
*((_QWORD *)&v64 + 1) = KeyValueInformation;
LODWORD(v65) = Length;
*((_QWORD *)&v65 + 1) = a1;
v26 = CmpCallCallBacksEx(RegNtQueryValueKey, Argument, 0i64, 1, RegNtPostQueryValueKey, (INT64)DmaAdapter, (INT64)v56);
v16 = v26;
v41 = v26;
if( v26 >= 0 )
{
v42 = 1;
goto LABEL_58;
}
DmaOperations = v48;
if( v26 == -1073740541 )
{
v16 = 0;
v41 = 0;
}
LABEL_79:
if( v55 )
HalPutDmaAdapter(v55);
if( v42 )
{
if( dword_140C5083C
&& !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v12, v14)
&& (INT64 *)v56[0] != v56 )
{
v70 = 0;
v73 = 0i64;
v74 = 0i64;
v75 = 0;
v68 = (_SLIST_ENTRY *)DmaAdapter;
v69 = v16;
v72 = v16;
v71 = Argument;
CmpCallCallBacksEx(RegNtPostQueryValueKey, &v68, 0i64, 0, RegNtPostQueryValueKey, (INT64)DmaAdapter, (INT64)v56);
v16 = v72;
}
v41 = v16;
}
if( v43 )
{
v30 = (_ETHREAD *)KeGetCurrentThread();
v31 = v30->Tcb.KernelApcDisable++ == -1;
if( v31
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v30->Tcb.ApcState.ApcListHead[0].Flink != &v30->Tcb.152
&& !v30->Tcb.SpecialApcDisable )
{
KiCheckForKernelApcDelivery();
}
v16 = v41;
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
if( Src[1] && Src[1] != Src[0] && Src[1] != v81 )
{
if( (v80 & 1) != 0 )
{
++*(&WheapErrorSourceTable + 401);
if( *(&WheapErrorSourceTable + 788) >= *(&WheapErrorSourceTable + 796) )
{
++*(&WheapErrorSourceTable + 402);
(*(&WheapErrorSourceTable + 204))(Src[1], (char *)&WheapErrorSourceTable + 1576);
}
else
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)((char *)&WheapErrorSourceTable + 1576), (PSLIST_ENTRY)Src[1]);
}
}
else
{
CmSiFreeMemory((PPRIVILEGE_SET)Src[1]);
}
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
p_DestinationString = &DestinationString;
LOBYTE(p_DestinationString) = 16;
(*(void(__fastcall **)(_UNICODE_STRING *, _LARGE_INTEGER *, _QWORD, _QWORD, _DMA_OPERATIONS *, _UNICODE_STRING *))((char *)&NlsMbCodePageTag + 7))(
p_DestinationString,
TimeStamp,
(unsigned int)v16,
(unsigned int)v46,
DmaOperations,
&DestinationString);
}
if( Privileges && Privileges != (PPRIVILEGE_SET)v94 )
CmSiFreeMemory(Privileges);
if( v45 )
{
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v41;
}
return v16;
}Referenced by:
ExpWatchProductTypeInitialization
ExpWatchProductTypeWork
InitSafeBoot
IoInitSystemPreDrivers
IopLoadDriver
IopProtectSystemPartition