NtCompressKey

NTSTATUS __stdcall NtCompressKey(VOID *Key){
  NTSTATUS v2; 
  char PreviousMode; 
  INT8 v4; 
  PVOID *v5; 
  int v6; 
  _ETHREAD *CurrentThread; 
  CM_KEY_BODY *v8; 
  _CM_KEY_CONTROL_BLOCK *KeyControlBlock; 
  _HHIVE *KeyHive; 
  _HIVE_WRITE_WAIT_QUEUE *p_Display; 
  UINT64 v12; 
  PADAPTER_OBJECT DmaAdapter; 
  _KAPC_STATE ApcState; 

  DmaAdapter = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v2 = CmCheckNoTxContext();
  if( v2 >= 0 )
  {
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    if( SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, PreviousMode) )
    {
      LOBYTE(v5) = PreviousMode;
      v6 = (unsigned __int8)Key & 3;
      v2 = CmObReferenceObjectByHandle(Key, 0x20006ui64, v4, v5, (OBJECT_HANDLE_INFORMATION *)&DmaAdapter);
      if( v2 >= 0 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132) )
        {
          v8 = (CM_KEY_BODY *)DmaAdapter;
          while( 1 )
          {
            CmpLockRegistryExclusive();
            v2 = CmpPerformKeyBodyDeletionCheck(v8, 0i64);
            if( v2 < 0 )
              break;
            KeyControlBlock = v8->KeyControlBlock;
            KeyHive = KeyControlBlock->KeyHash.KeyHive;
            if( KeyControlBlock->KeyHash.KeyCell != KeyHive->BaseBlock->RootCell )
            {
              v2 = -1073741811;
              break;
            }
            p_Display = (_HIVE_WRITE_WAIT_QUEUE *)&KeyHive[2].Storage[1].FreeDisplay[10];
            if( !PoIsInitializedStopWatch(&KeyHive[2].Storage[1].FreeDisplay[10].RealVectorSize) )
            {
              p_Display = (_HIVE_WRITE_WAIT_QUEUE *)&KeyHive[2].Storage[1].FreeDisplay[9].Display;
              if( !PoIsInitializedStopWatch(&KeyHive[2].Storage[1].FreeDisplay[9].Display.SizeOfBitMap) )
              {
                CmpAttachToRegistryProcess(&ApcState);
                v2 = CmCompressKey(v8->KeyControlBlock->KeyHash.KeyHive, v6);
                KiUnstackDetachProcess(&ApcState, 0i64);
                break;
              }
            }
            ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&KeyHive->FlusherLock, 0i64);
            CmpWaitOnHiveWriteQueue((_CMHIVE *)KeyHive, p_Display, v12);
          }
          CmpUnlockRegistry();
          ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
        }
        else
        {
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          v2 = -1073741431;
        }
      }
      if( DmaAdapter )
        HalPutDmaAdapter(DmaAdapter);
    }
    else
    {
      return -1073741727;
    }
  }
  return v2;
}

Referenced by: