NtDeleteValueKey
NTSTATUS __stdcall NtDeleteValueKey(VOID *KeyHandle, _UNICODE_STRING *ValueName, _OBJECT_TYPE *a3){
char v4;
_DMA_OPERATIONS *DmaOperations;
unsigned int PreviousMode;
char v7;
_ETHREAD *CurrentThread;
UINT8 v9;
INT8 v10;
PVOID *v11;
unsigned __int64 v12;
NTSTATUS v13;
INT64 v14;
int v15;
wchar_t *Buffer;
unsigned int v17;
char *v18;
INT64 v19;
_PRIVILEGE_SET *TransientPoolWithQuotaTag;
char v21;
char v22;
char *i;
_ETHREAD *v24;
INT8 v26;
PVOID *v27;
VOID **v28;
char v29;
NTSTATUS v30;
UINT8 v31;
PADAPTER_OBJECT DmaAdapter[2];
VOID *Src[2];
int v34;
__int64 v35;
PVOID Handle;
PPRIVILEGE_SET Privileges;
_DMA_OPERATIONS *v38;
INT64 a6[3];
__int128 v40;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
_SLIST_ENTRY *Argument[2];
__int128 v43;
__int64 v44;
UNICODE_STRING ValueNamea;
__int128 TimeStamp[2];
Handle = KeyHandle;
*(_OWORD *)Argument = 0i64;
v43 = 0i64;
v44 = 0i64;
v35 = 0i64;
*(_OWORD *)Src = 0i64;
Privileges = 0i64;
v4 = 0;
v34 = 0;
memset(TimeStamp, 0, sizeof(TimeStamp));
DmaOperations = 0i64;
v38 = 0i64;
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
EtwGetKernelTraceTimestamp((_LARGE_INTEGER *)TimeStamp, 0x20000ui64);
v29 = 0;
DmaAdapter[0] = 0i64;
a6[1] = (INT64)a6;
a6[0] = (INT64)a6;
PreviousMode = KeGetCurrentThread()->PreviousMode;
v7 = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v9 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
v31 = v9;
if( !v9 )
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( !v9 )
{
v13 = -1073741431;
goto LABEL_54;
}
LOBYTE(v11) = PreviousMode;
v13 = CmObReferenceObjectByHandle(Handle, 2ui64, v10, v11, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
v30 = v13;
if( v13 != -1073741790 )
goto LABEL_7;
SeCaptureSubjectContext((INT64)&SubjectContext);
v7 = 1;
if( !CmDoVirtualTest(&SubjectContext, &v34) )
goto LABEL_53;
LOBYTE(v27) = PreviousMode;
v13 = CmObReferenceObjectByHandle(Handle, 0x20019ui64, v26, v27, (OBJECT_HANDLE_INFORMATION *)DmaAdapter);
v30 = v13;
if( v13 < 0 )
goto LABEL_55;
if( !CmKeyBodyNeedsVirtualImage((__int64)DmaAdapter[0]) )
{
LABEL_53:
v13 = -1073741790;
LABEL_54:
v30 = v13;
goto LABEL_55;
}
v4 = 1;
LABEL_7:
v7 = v4;
if( v13 < 0 )
{
LABEL_55:
v21 = 0;
v22 = 0;
goto LABEL_37;
}
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && DmaAdapter[0] )
{
DmaOperations = DmaAdapter[0]->AdapterObject.DmaHeader.DmaOperations;
v38 = DmaOperations;
}
if( (_BYTE)PreviousMode == 1 )
{
v40 = 0i64;
v14 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
ValueName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
v15 = *(_DWORD *)&ValueName->Length;
LODWORD(v40) = v15;
Buffer = ValueName->Buffer;
*((_QWORD *)&v40 + 1) = Buffer;
*(_OWORD *)Src = v40;
if( (_WORD)v15 )
{
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v12 = (unsigned __int64)Buffer + (unsigned __int16)v15;
if( v12 > 0x7FFFFFFF0000i64 || v12 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
*(_UNICODE_STRING *)Src = *ValueName;
}
v17 = LOWORD(Src[0]);
v18 = (char *)((unsigned __int64)Src[1] & -(__int64)(LOWORD(Src[0]) != 0));
Src[1] = v18;
WORD1(Src[0]) = Src[0];
if( LOWORD(Src[0]) && CmpDoesBufferRequireCapturing(PreviousMode, v18) )
{
TransientPoolWithQuotaTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithQuotaTag(v19, v17, 0x62634D43ui64);
Privileges = TransientPoolWithQuotaTag;
if( !TransientPoolWithQuotaTag )
{
v13 = -1073741670;
v30 = -1073741670;
v7 = v4;
v21 = 0;
v22 = 0;
goto LABEL_37;
}
v18 = (char *)TransientPoolWithQuotaTag;
memmove(TransientPoolWithQuotaTag, Src[1], LOWORD(Src[0]));
Src[1] = v18;
LOWORD(v17) = Src[0];
}
if( ((__int64)Src[0] & 1) != 0 )
{
LOWORD(Src[0]) = 0;
v13 = -1073741811;
}
else
{
if( (LODWORD(DmaAdapter[0]->AdapterObject.DmaHeader.DmaOperations->PutDmaAdapter) & 0x80u) == 0 )
{
for( i = &v18[2 * ((unsigned __int64)(unsigned __int16)v17 >> 1) - 2]; (_WORD)v17 && !*(_WORD *)i; i -= 2 )
{
LOWORD(v17) = v17 - 2;
LOWORD(Src[0]) = v17;
}
v24 = (_ETHREAD *)KeGetCurrentThread();
--v24->Tcb.KernelApcDisable;
v21 = 1;
if( dword_140C5083C && !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v12, v14) )
{
Argument[0] = (_SLIST_ENTRY *)DmaAdapter[0];
Argument[1] = (_SLIST_ENTRY *)Src;
v13 = CmpCallCallBacksEx(
RegNtDeleteValueKey,
Argument,
0i64,
1,
RegNtPostDeleteValueKey,
(INT64)DmaAdapter[0],
(INT64)a6);
if( v13 < 0 )
{
if( v13 == -1073740541 )
v13 = 0;
goto LABEL_70;
}
v29 = 1;
}
if( !v4 )
goto LABEL_34;
v13 = CmKeyBodyRemapToVirtual((__int64 *)DmaAdapter, PreviousMode, 2u, &SubjectContext, &v34);
v30 = v13;
v7 = v4;
if( v13 < 0 )
goto LABEL_36;
if( CmpVEEnabled
&& ((__int64)DmaAdapter[0]->AdapterObject.DmaHeader.DmaOperations->MapTransferEx & 0x1000000) != 0 )
{
LABEL_34:
ValueNamea = *(UNICODE_STRING *)Src;
v13 = CmDeleteValueKey((CM_KEY_BODY *)DmaAdapter[0], &ValueNamea, (LIST_ENTRY *)Handle, (v35 & 4) != 0);
v30 = v13;
LABEL_35:
v7 = v4;
LABEL_36:
v22 = v29;
goto LABEL_37;
}
v13 = -1073741790;
LABEL_70:
v30 = v13;
goto LABEL_35;
}
v13 = -1073741790;
}
v30 = v13;
v7 = v4;
v21 = 0;
v22 = 0;
LABEL_37:
if( v7 )
SeReleaseSubjectContext(&SubjectContext);
if( v22 )
{
v13 = CmPostCallbackNotificationEx(
RegNtPostDeleteValueKey,
(_SLIST_ENTRY *)DmaAdapter[0],
(unsigned int)v13,
(INT64)Argument,
0i64,
(INT64)a6);
v30 = v13;
}
if( v21 )
{
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v13 = v30;
}
if( DmaAdapter[0] )
HalPutDmaAdapter(DmaAdapter[0]);
if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
{
v28 = Src;
LOBYTE(v28) = 15;
(*(void(__fastcall **)(VOID **, __int128 *, _QWORD, _QWORD, _DMA_OPERATIONS *, VOID **))((char *)&NlsMbCodePageTag
+ 7))(
v28,
TimeStamp,
(unsigned int)v13,
0i64,
DmaOperations,
Src);
}
if( Privileges )
CmSiFreeMemory(Privileges);
if( v31 )
{
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&CmpDummyThreadEvent + 132);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v30;
}
return v13;
}Referenced by:
ExpWatchProductTypeWork