CmpCreateHive
INT64 __fastcall CmpCreateHive(
INT64 a1,
UINT64 a2,
UINT64 a3,
UINT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
UINT64 Flags,
INT64 a9,
INT64 a10,
INT64 a11,
INT64 a12){
unsigned int v12;
__int64 v13;
BOOL v14;
__int64 v15;
__int64 v16;
int VolumeClusterSize;
int ContextForFile;
CMHIVE *v19;
VOID *v20;
UINT64 v21;
UINT64 v22;
VOID *v23;
UINT64 v24;
UINT64 *v25;
VOID *v26;
INT64 v27;
INT64 v28;
int v29;
__int64 v30;
int v31;
int started;
_QWORD *v33;
_QWORD *v34;
__int64 v36;
_QWORD *v37;
INT64 v38;
VOID *v39;
INT64 v40;
int v41;
int v42;
int v43;
int v44;
__int64 v45;
UINT64 Point;
UINT64 Pointa;
INT64 v48;
INT64 v49;
BOOL v50;
__int16 ObjectInformation[2];
char v52;
UINT64 pCluster;
INT64 v54;
_UNICODE_STRING *FileName;
_HBASE_BLOCK *BaseBlock;
__int64 v57;
__int64 v58;
__int64 v59;
INT64 v60;
__int64 v61[2];
__int128 v62;
bool(__fastcall *v63)(_HHIVE *, UINT64, UINT *, void *, UINT64);
_KAPC_STATE ApcState;
_EVENT_DATA_DESCRIPTOR v65;
INT64 *v66;
__int64 v67;
__int16 *v68;
__int64 v69;
UINT64 *p_pCluster;
__int64 v71;
__int64 v72;
__int64 v73;
INT64 v74;
__int64 v75;
INT64 v76;
int v77;
int v78;
INT64 v79;
__int64 v80;
INT64 v81;
int v82;
int v83;
INT64 v84;
__int64 v85;
INT64 v86;
int v87;
int v88;
_HBASE_BLOCK **p_BaseBlock;
__int64 v90;
HIDWORD(pCluster) = a2;
v12 = a3;
FileName = (_UNICODE_STRING *)a7;
v13 = 0i64;
v14 = 0;
v59 = a9;
v58 = a10;
v57 = a11;
v60 = a1;
v54 = (unsigned int)a4;
BaseBlock = (_HBASE_BLOCK *)a5;
v63 = 0i64;
v52 = 0;
*(_OWORD *)v61 = 0i64;
v62 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
if( (unsigned int)a2 > 2 && (_DWORD)a2 != 5 )
{
LODWORD(Point) = 0;
ContextForFile = -1073741811;
SetFailureLocation((_HIVE_LOAD_FAILURE *)a12, 0i64, _CmpCreateHive, 3221225485i64, Point);
goto LABEL_104;
}
if( (a3 & 0xFF617CEC) != 0 )
{
LODWORD(Point) = 16;
LABEL_79:
ContextForFile = -1073741811;
SetFailureLocation((_HIVE_LOAD_FAILURE *)a12, 0i64, _CmpCreateHive, 3221225485i64, Point);
return(unsigned int)ContextForFile;
}
if( (unsigned int)a4 > 2 )
{
LODWORD(Point) = 32;
goto LABEL_79;
}
if( !a5 && (_DWORD)a2 == 1 )
{
LODWORD(Point) = 48;
goto LABEL_79;
}
if( a6 )
{
if( (a3 & 1) != 0 && (a3 & 0x8000) == 0 )
{
LODWORD(Point) = 64;
goto LABEL_79;
}
if( !*(_QWORD *)a6 && (*(_QWORD *)(a6 + 8) || *(_QWORD *)(a6 + 16)) )
{
LODWORD(Point) = 80;
goto LABEL_79;
}
v15 = *(_QWORD *)(a6 + 8);
if( v15 && !(_DWORD)a4 )
{
LODWORD(Point) = 96;
goto LABEL_79;
}
v16 = *(_QWORD *)(a6 + 16);
if( v16 && (_DWORD)a4 != 2 )
{
LODWORD(Point) = 112;
goto LABEL_79;
}
if( *(_QWORD *)(a6 + 24) && (*(_QWORD *)a6 || v15 || v16) )
{
LODWORD(Point) = 128;
goto LABEL_79;
}
}
v50 = CmpAcquireShutdownRundown();
v14 = v50;
if( !v50 )
return(unsigned int)-1073741431;
LODWORD(pCluster) = 1;
if( a6
&& *(_QWORD *)a6
&& (VolumeClusterSize = CmpGetVolumeClusterSize(*(VOID **)a6, &pCluster),
ContextForFile = VolumeClusterSize,
VolumeClusterSize < 0) )
{
LODWORD(Point) = 160;
v38 = (unsigned int)VolumeClusterSize;
}
else
{
v19 = (CMHIVE *)CmpAllocate(0x12E8ui64, 0, 0x30314D43ui64);
v13 = (__int64)v19;
if( v19 )
{
CmpHiveInitialize(v19);
if( a6 )
{
if( *(_QWORD *)a6 )
{
LODWORD(v49) = 2;
LODWORD(v48) = 512;
LODWORD(Point) = 0;
ContextForFile = ObDuplicateObject(
(INT64)PsInitialSystemProcess,
*(_QWORD *)a6,
0i64,
(UINT64 *)(v13 + 1536),
Point,
v48,
v49,
0);
if( ContextForFile < 0 )
goto LABEL_103;
v20 = *(VOID **)(v13 + 1536);
ObjectInformation[0] = 256;
ZwSetInformationObject(v20, ObjectHandleFlagInformation, ObjectInformation, 2ui64);
}
v21 = *(_QWORD *)(a6 + 24);
if( v21 )
{
LODWORD(v49) = 2;
LODWORD(v48) = 512;
LODWORD(Point) = 0;
ContextForFile = ObDuplicateObject(
(INT64)PsInitialSystemProcess,
v21,
0i64,
(UINT64 *)(v13 + 1552),
Point,
v48,
v49,
0);
if( ContextForFile < 0 )
goto LABEL_103;
v39 = *(VOID **)(v13 + 1552);
ObjectInformation[0] = 256;
ZwSetInformationObject(v39, ObjectHandleFlagInformation, ObjectInformation, 2ui64);
}
if( (_DWORD)v54 != 1 )
{
if( (_DWORD)v54 != 2 )
goto LABEL_33;
v22 = *(_QWORD *)(a6 + 8);
if( v22 )
{
LODWORD(v49) = v54;
LODWORD(v48) = 512;
LODWORD(Point) = 0;
ContextForFile = ObDuplicateObject(
(INT64)PsInitialSystemProcess,
v22,
0i64,
(UINT64 *)(v13 + 1568),
Point,
v48,
v49,
0);
if( ContextForFile < 0 )
goto LABEL_103;
v23 = *(VOID **)(v13 + 1568);
ObjectInformation[0] = 256;
ZwSetInformationObject(v23, ObjectHandleFlagInformation, ObjectInformation, 2ui64);
}
v24 = *(_QWORD *)(a6 + 16);
if( !v24 )
goto LABEL_33;
v25 = (UINT64 *)(v13 + 1576);
goto LABEL_31;
}
v24 = *(_QWORD *)(a6 + 8);
if( v24 )
{
v25 = (UINT64 *)(v13 + 1544);
LABEL_31:
LODWORD(v49) = 2;
LODWORD(v48) = 512;
LODWORD(Point) = 0;
ContextForFile = ObDuplicateObject((INT64)PsInitialSystemProcess, v24, 0i64, v25, Point, v48, v49, 0);
if( ContextForFile < 0 )
goto LABEL_103;
v26 = (VOID *)*v25;
ObjectInformation[0] = 256;
ZwSetInformationObject(v26, ObjectHandleFlagInformation, ObjectInformation, 2ui64);
}
}
LABEL_33:
if( (Flags & 0x8000000) != 0 )
*(_DWORD *)(v13 + 4152) |= 0x80u;
if( (Flags & 0x80000000) != 0i64 )
*(_DWORD *)(v13 + 4152) |= 0x800u;
CmpAttachToRegistryProcess(&ApcState);
v52 = 1;
v61[0] = (__int64)CmpAllocate;
v61[1] = (__int64)CmpFree;
*((_QWORD *)&v62 + 1) = CmpFileWrite;
v63 = CmpFileRead;
v29 = HIDWORD(pCluster);
*(_QWORD *)(v13 + 56) = a12;
*(_QWORD *)a12 = v13;
if( v29 != 5 && v29 != 2 && (v29 || !a6 || !*(_QWORD *)a6) )
{
v31 = HIDWORD(pCluster);
started = HvHiveStartMemoryBacked(
(_HHIVE *)v13,
HIDWORD(pCluster),
v12,
v54,
BaseBlock,
(__int64)v61,
pCluster,
FileName,
v59,
v58,
v57,
(__int64)&v54 + 4,
(_HIVE_LOAD_FAILURE *)a12);
ContextForFile = started;
if( started < 0 )
{
LODWORD(Pointa) = 232;
LABEL_99:
v40 = (unsigned int)started;
LABEL_102:
SetFailureLocation((_HIVE_LOAD_FAILURE *)a12, 0i64, _CmpCreateHive, v40, Pointa);
goto LABEL_103;
}
goto LABEL_43;
}
v12 |= 0x20000u;
ContextForFile = CmpVolumeManagerGetContextForFile(v27, *(VOID **)a6, v28, (INT64 *)(v13 + 4832));
if( ContextForFile >= 0 )
{
if( CmpVolumeContextMustHiveFilePagesBeKeptLocal(*(_QWORD *)(v13 + 4832)) || (Flags & 0x2000000) != 0 )
v12 |= 0x800000u;
v31 = HIDWORD(pCluster);
LOBYTE(v30) = HIDWORD(pCluster) == 0;
started = HvHiveStartFileBacked(
(_HHIVE *)v13,
v30,
v12,
v54,
(__int64)v61,
pCluster,
v49,
FileName,
v59,
v58,
v57,
(__int64)&v54 + 4,
(_HIVE_LOAD_FAILURE *)a12);
ContextForFile = started;
if( started < 0 )
{
LODWORD(Pointa) = 228;
goto LABEL_99;
}
LABEL_43:
if( (v12 & 0x180000) == 0x80000 && (Flags & 0x800000) == 0 )
{
v36 = *(_QWORD *)(v13 + 64);
if( *(_DWORD *)(v36 + 24) < 6u || (*(_DWORD *)(v36 + 144) & 2) == 0 )
{
ContextForFile = -1073741811;
goto LABEL_103;
}
}
if( ((v31 - 1) & 0xFFFFFFFA) != 0 || v31 == 6 )
goto LABEL_114;
ContextForFile = CmCheckRegistry(v13, (unsigned int)Flags, (_HIVE_LOAD_FAILURE *)a12);
if( ContextForFile == -2147483606 )
{
if( *(&stru_140C00F40 + 1148) <= 5u )
{
ContextForFile = 0;
}
else
{
ContextForFile = 0;
if( tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
LODWORD(v54) = v41;
v66 = &v54;
v68 = ObjectInformation;
v42 = *(unsigned __int16 *)(a12 + 8);
v43 = *(unsigned __int16 *)(a12 + 10);
v74 = a12 + 8;
p_pCluster = &pCluster;
v76 = a12 + 12;
v44 = *(unsigned __int8 *)(a12 + 394);
v77 = 12 * v42;
v81 = a12 + 108;
v82 = 12 * v43;
v86 = a12 + 396;
p_BaseBlock = &BaseBlock;
WORD2(pCluster) = v44;
ObjectInformation[0] = v42;
LOWORD(pCluster) = v43;
v79 = a12 + 10;
v84 = a12 + 394;
v67 = 4i64;
v69 = 2i64;
v71 = 2i64;
v72 = (__int64)&pCluster + 4;
v73 = 2i64;
v75 = 2i64;
v78 = 0;
v80 = 2i64;
v83 = 0;
v85 = 2i64;
v87 = 8 * v44;
v88 = 0;
BaseBlock = (_HBASE_BLOCK *)0x1000000;
v90 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)&word_1400225CE,
0i64,
0i64,
0xDu,
&v65);
}
}
}
if( ContextForFile >= 0 )
{
LABEL_114:
if( (Flags & 0x800000) != 0 )
{
v45 = *(_QWORD *)(v13 + 64);
if( *(_DWORD *)(v45 + 24) < 6u || (*(_DWORD *)(v45 + 144) & 2) == 0 )
{
HvMarkBaseBlockDirty((_HHIVE *)v13);
*(_DWORD *)(*(_QWORD *)(v13 + 64) + 24i64) = 6;
*(_DWORD *)(*(_QWORD *)(v13 + 64) + 144i64) |= 2u;
}
}
CmpReorganizeHive((CMHIVE *)v13, FileName);
CmpLockRegistry();
HvLockHiveFlusherShared(v13);
HvLockHiveWriter(v13);
if( v31 )
{
ContextForFile = HvCheckAndUpdateHiveBackupTimeStamp((_HHIVE *)v13);
}
else
{
*(_BYTE *)(v13 + 191) = 1;
ContextForFile = 0;
}
HvUnlockHiveWriter(v13);
HvUnlockHiveFlusherShared(v13);
CmpUnlockRegistry();
if( ContextForFile >= 0 )
{
v33 = (_QWORD *)(v13 + 1600);
if( (Flags & 0x1000000) != 0 )
{
*(_QWORD *)(v13 + 1608) = v13 + 1600;
*v33 = v33;
}
else
{
CmpLockHiveListExclusive();
v37 = (_QWORD *)qword_140D2D918;
if( *(__int64 **)qword_140D2D918 != &CmpHiveListHead )
__fastfail(3u);
*v33 = &CmpHiveListHead;
*(_QWORD *)(v13 + 1608) = v37;
*v37 = v33;
qword_140D2D918 = v13 + 1600;
CmpUnlockHiveList();
CmpRecheckHiveVolumePolicy(v13);
}
v34 = (_QWORD *)v60;
*(_QWORD *)(v13 + 56) = 0i64;
*v34 = v13;
CmpReleaseShutdownRundown();
v14 = 0;
ContextForFile = 0;
LABEL_55:
CmpDetachFromRegistryProcess(&ApcState);
goto LABEL_56;
}
LODWORD(Pointa) = 256;
}
else
{
LODWORD(Pointa) = 240;
}
v40 = (unsigned int)ContextForFile;
goto LABEL_102;
}
LABEL_103:
v14 = v50;
LABEL_104:
if( v13 )
CmpDestroyHive((PVOID)v13);
if( !v52 )
goto LABEL_56;
goto LABEL_55;
}
ContextForFile = -1073741670;
LODWORD(Point) = 176;
v38 = 3221225626i64;
}
SetFailureLocation((_HIVE_LOAD_FAILURE *)a12, 0i64, _CmpCreateHive, v38, Point);
LABEL_56:
if( v14 )
CmpReleaseShutdownRundown();
return(unsigned int)ContextForFile;
}Referenced by:
CmInitSystem1
CmRestoreKey
CmpCreateTemporaryHive
CmpInitHiveFromFile
CmpInitializePreloadedHive
CmpInitializeSystemHive
CmpLoadHiveVolatile
CmpRefreshHive