32 if (CapturedObjectAttributes->SecurityDescriptor)
38 CapturedObjectAttributes->SecurityDescriptor =
NULL;
42 if (CapturedObjectAttributes->ObjectName)
66 RtlZeroMemory(CapturedObjectAttributes,
sizeof(*CapturedObjectAttributes));
111 &CapturedObjectAttributes->
116 CapturedObjectAttributes->SecurityDescriptor =
NULL;
122 CapturedObjectAttributes->SecurityDescriptor =
NULL;
141 CapturedObjectAttributes->SecurityQualityOfService = *SecurityQos;
142 CapturedObjectAttributes->SecurityQos =
143 &CapturedObjectAttributes->SecurityQualityOfService;
146 CapturedObjectAttributes->SecurityQualityOfService =
NULL;
152 LocalObjectName =
NULL;
174 if (CapturedObjectAttributes->RootDirectory)
181 CapturedObjectAttributes->ObjectName =
ObjectName;
254 DPRINT(
"NtCreateKey(Path: %wZ, Root %x, Access: %x, CreateOptions %x)\n",
345 DPRINT(
"NtOpenKey(Path: %wZ, Root %x, Access: %x)\n",
470 DPRINT(
"NtEnumerateKey() KH 0x%p, Index 0x%x, KIC %d, Length %lu\n",
557 DPRINT(
"NtEnumerateValueKey() KH 0x%p, Index 0x%x, KVIC %d, Length %lu\n",
609 &EnumerateValueKeyInfo);
645 DPRINT(
"NtQueryKey() KH 0x%p, KIC %d, Length %lu\n",
760 DPRINT(
"NtQueryValueKey() KH 0x%p, VN '%wZ', KVIC %d, Length %lu\n",
816 while ((ValueNameCopy.
Length) &&
826 QueryValueKeyInfo.
ValueName = &ValueNameCopy;
946 DPRINT(
"NtSetValueKey() KH 0x%p, VN '%wZ', TI %x, T %lu, DS %lu\n",
950 if ( (ValueNameCopy.
Length > 32767) ||
960 while ((ValueNameCopy.
Length) &&
978 SetValueKeyInfo.
ValueName = &ValueNameCopy;
1001 if (ValueNameCopy.
Buffer)
1061 &DeleteValueKeyInfo);
1071 &PostOperationInfo);
1075 if (ValueNameCopy.
Buffer)
1107 if (KeyObject->KeyControlBlock->Delete)
1170 DPRINT1(
"Restore Privilege missing!\n");
1231 &KmTargetKeyRootDir);
1242 &KmSourceFileRootDir);
1262 &CapturedSourceFile,
1271 if (KmSourceFileRootDir)
1273 if (KmTargetKeyRootDir)
1400 #define PRODUCT_ACTIVATION_VERSION 7749 1413 if (pPrivateVer !=
NULL)
1426 if (pSafeMode !=
NULL)
1498 DPRINT(
"NtQueryOpenSubKeys()\n");
1560 DPRINT(
"Error: Key is not a hive root key!\n");
1579 *HandleCount = SubKeys;
1718 DPRINT(
"NtSaveMergedKeys(0x%p, 0x%p, 0x%p)\n",
1719 HighPrecedenceKeyHandle, LowPrecedenceKeyHandle,
FileHandle);
1743 (
PVOID*)&HighPrecedenceKeyObject,
1752 (
PVOID*)&LowPrecedenceKeyObject,
1759 LowPrecedenceKeyObject->KeyControlBlock,
1764 if (LowPrecedenceKeyObject)
1766 if (HighPrecedenceKeyObject)
1781 IN ULONG KeyInformationLength)
1806 ULONG ParentConv = 0, ChildConv = 0;
1814 DPRINT1(
"Restore Privilege missing!\n");
1829 CapturedTargetKey = *TargetKey;
1849 CapturedTargetKey = *TargetKey;
1857 &KmTargetKeyRootDir);
1891 if (KmTargetKeyRootDir)
1948 DPRINT1(
"NtUnloadKey2(%wZ): We want to force-unload the hive but couldn't unload it: Retrying is UNIMPLEMENTED!\n", TargetKey->ObjectName);
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
#define ProbeForWriteUlong(Ptr)
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
static const WCHAR Class[]
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
NTSTATUS NTAPI NtCompressKey(IN HANDLE Key)
#define PRODUCT_ACTIVATION_VERSION
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
#define STATUS_PRIVILEGE_NOT_HELD
NTSTATUS NTAPI NtUnloadKey2(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
NTSTATUS NTAPI CmLoadKey(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN PCM_KEY_BODY KeyBody)
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
NTSTATUS NTAPI NtQueryValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
VOID(* PIO_APC_ROUTINE)(IN PVOID ApcContext, IN PIO_STATUS_BLOCK IoStatusBlock, IN ULONG Reserved)
#define STATUS_INSUFFICIENT_RESOURCES
NTSTATUS NTAPI CmFlushKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN BOOLEAN ExclusiveLock)
_In_ ULONG _In_ ULONG _In_ ULONG Length
static ACCESS_MASK const OBJECT_ATTRIBUTES ULONG TitleIndex
#define REG_STANDARD_FORMAT
NTSTATUS NTAPI NtCreateKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class OPTIONAL, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL)
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
_In_ ULONG _In_ KEY_INFORMATION_CLASS KeyInformationClass
enum _KEY_INFORMATION_CLASS KEY_INFORMATION_CLASS
const LUID SeBackupPrivilege
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
#define STATUS_INVALID_PARAMETER
NTSTATUS NTAPI CmEnumerateValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
NTSTATUS NTAPI CmSaveKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN HANDLE FileHandle, IN ULONG Flags)
ULONG NTAPI CmpEnumerateOpenSubKeys(IN PCM_KEY_CONTROL_BLOCK RootKcb, IN BOOLEAN RemoveEmptyCacheEntries, IN BOOLEAN DereferenceOpenedEntries)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
#define CM_BOOT_FLAG_ACCEPTED
NTSTATUS NTAPI NtUnloadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN HANDLE Event)
#define KeGetPreviousMode()
NTSTATUS NTAPI CmDeleteValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName)
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
#define CM_KCB_READ_ONLY_KEY
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
NTSTATUS NTAPI NtSaveKey(IN HANDLE KeyHandle, IN HANDLE FileHandle)
NTSTATUS NTAPI NtRestoreKey(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG RestoreFlags)
NTSTATUS NTAPI NtNotifyChangeMultipleKeys(IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
NTSTATUS NTAPI NtQueryKey(IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
#define OBJ_KERNEL_HANDLE
#define CmpAcquireKcbLockShared(k)
NTSTATUS NTAPI NtDeleteValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
NTSTATUS NTAPI NtLockProductActivationKeys(IN PULONG pPrivateVer, IN PULONG pSafeMode)
VOID NTAPI CmpReleaseTwoKcbLockByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
NTSTATUS NTAPI CmpSaveBootControlSet(IN USHORT ControlSet)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
VOID ReleaseCapturedObjectAttributes(_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
_In_ PWDFDEVICE_INIT _In_ PWDF_FILEOBJECT_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES FileObjectAttributes
NTSTATUS NTAPI NtSetValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex, IN ULONG Type, IN PVOID Data, IN ULONG DataSize)
return STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI NtLockRegistryKey(IN HANDLE KeyHandle)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
_In_ SYSTEM_POWER_STATE _In_ ULONG _In_ BOOLEAN Asynchronous
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
NTSTATUS NTAPI NtSetInformationKey(IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG KeyInformationLength)
NTSTATUS NTAPI NtLoadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
NTSTATUS NTAPI NtInitializeRegistry(IN USHORT Flag)
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
enum _KEY_SET_INFORMATION_CLASS KEY_SET_INFORMATION_CLASS
NTSTATUS NTAPI NtLoadKey2(IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes, IN ULONG Flags)
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
NTSTATUS ProbeAndCaptureObjectAttributes(_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
NTSTATUS NTAPI NtQueryOpenSubKeys(IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount)
VOID NTAPI CmpLockRegistryExclusive(VOID)
NTSTATUS NTAPI NtQueryMultipleValueKey(IN HANDLE KeyHandle, IN OUT PKEY_VALUE_ENTRY ValueList, IN ULONG NumberOfValues, OUT PVOID Buffer, IN OUT PULONG Length, OUT PULONG ReturnLength)
#define STATUS_KEY_DELETED
FORCEINLINE VOID CmpReleaseKcbLock(PCM_KEY_CONTROL_BLOCK Kcb)
#define OBJ_VALID_KERNEL_ATTRIBUTES
NTSTATUS NTAPI CmSetValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PUNICODE_STRING ValueName, IN ULONG Type, IN PVOID Data, IN ULONG DataLength)
struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
NTSTATUS NTAPI NtLoadKey(IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes)
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
NTSTATUS NTAPI NtReplaceKey(IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE Key, IN POBJECT_ATTRIBUTES ReplacedObjectAttributes)
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
_In_ KPROCESSOR_MODE PreviousMode
NTSTATUS NTAPI NtNotifyChangeKey(IN HANDLE KeyHandle, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
_Must_inspect_result_ _In_ ULONG Flags
const LUID SeRestorePrivilege
#define NT_SUCCESS(StatCode)
_In_ WDFCOLLECTION _In_ ULONG Index
#define EXCEPTION_EXECUTE_HANDLER
VOID NTAPI CmpUnlockRegistry(VOID)
NTSTATUS NTAPI SeCaptureSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor)
Captures a security descriptor.
#define ObDereferenceObject
NTSTATUS NTAPI CmQueryKey(_In_ PCM_KEY_CONTROL_BLOCK Kcb, _In_ KEY_INFORMATION_CLASS KeyInformationClass, _Out_opt_ PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength)
NTSTATUS NTAPI NtUnloadKey(IN POBJECT_ATTRIBUTES KeyObjectAttributes)
#define ProbeForWriteHandle(Ptr)
NTSTATUS NTAPI NtQueryOpenSubKeysEx(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, IN PVOID Buffer, IN PULONG RequiredSize)
#define STATUS_ACCESS_DENIED
#define REG_OPTION_BACKUP_RESTORE
NTSTATUS NTAPI CmSaveMergedKeys(IN PCM_KEY_CONTROL_BLOCK HighKcb, IN PCM_KEY_CONTROL_BLOCK LowKcb, IN HANDLE FileHandle)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
#define ExAllocatePoolWithTag(hernya, size, tag)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
#define REG_NO_COMPRESSION
#define STATUS_CANNOT_DELETE
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
NTSYSAPI NTSTATUS NTAPI ZwInitializeRegistry(_In_ USHORT Flag)
#define REG_LATEST_FORMAT
#define KeEnterCriticalRegion()
NTSTATUS NTAPI NtEnumerateValueKey(IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
#define REG_NO_LAZY_FLUSH
NTSTATUS NTAPI SeReleaseSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ BOOLEAN CaptureIfKernelMode)
Releases a captured security descriptor buffer.
static const WCHAR Cleanup[]
POBJECT_TYPE IoFileObjectType
EX_PUSH_LOCK CmpLoadHiveLock
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_opt_ WDFKEY _In_ PCUNICODE_STRING _In_ ACCESS_MASK _In_ ULONG CreateOptions
NTSTATUS NTAPI CmUnloadKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Flags)
NTSTATUS NTAPI NtDeleteKey(IN HANDLE KeyHandle)
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
NTSTATUS NTAPI NtRenameKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ReplacementName)
NTSTATUS NTAPI CmQueryValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
#define KeLeaveCriticalRegion()
LONG NTAPI ExSystemExceptionFilter(VOID)
NTSTATUS NTAPI NtSaveKeyEx(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
NTSTATUS NTAPI NtFlushKey(IN HANDLE KeyHandle)
NTSTATUS NTAPI NtSaveMergedKeys(IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle)
#define STATUS_OBJECT_NAME_INVALID
static OUT PIO_STATUS_BLOCK IoStatusBlock
NTSTATUS NTAPI NtCompactKeys(IN ULONG Count, IN PHANDLE KeyArray)
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
#define ProbeForReadUnicodeString(Ptr)
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
PUNICODE_STRING ObjectName
BOOLEAN CmBootAcceptFirstTime
NTSTATUS NTAPI NtEnumerateKey(IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
#define RtlZeroMemory(Destination, Length)
#define RtlCopyMemory(Destination, Source, Length)
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
NTSTATUS NTAPI CmDeleteKey(IN PCM_KEY_BODY KeyBody)
VOID NTAPI CmpLazyFlush(VOID)
#define _SEH2_EXCEPT(...)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
#define _SEH2_GetExceptionCode()
VOID NTAPI CmpSetVersionData(VOID)
#define _SEH2_YIELD(__stmt)
NTSTATUS NTAPI CmEnumerateKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG Length, IN PULONG ResultLength)
_In_ ULONG _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
#define UNIMPLEMENTED_ONCE
#define CM_BOOT_FLAG_SETUP
VOID NTAPI CmpCmdInit(IN BOOLEAN SetupBoot)
#define ExFreePoolWithTag(_P, _T)
VOID NTAPI CmpLockRegistry(VOID)
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
VOID NTAPI CmpAcquireTwoKcbLocksExclusiveByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
NTSTATUS NTAPI NtOpenKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
enum _KEY_VALUE_INFORMATION_CLASS KEY_VALUE_INFORMATION_CLASS
#define KEY_ENUMERATE_SUB_KEYS
PULONG MinorVersion OPTIONAL