CmpFreezeHive

INT64 __fastcall CmpFreezeHive(INT64 a1, VOID *a2){
  CMHIVE *v2; 
  NTSTATUS v5; 

  v2 = *(CMHIVE **)(a1 + 32);
  CmpReferenceKeyControlBlockUnsafe((volatile INT64 *)a1);
  if( a2 && (v5 = CmpRecordUnloadEventForHive(v2, (KEVENT *)a2), v5 < 0) )
  {
    CmpDereferenceKeyControlBlockUnsafe((volatile INT64 *)a1);
  }
  else
  {
    CmpSearchForOpenSubKeys((_QWORD *)a1, 2, 0i64);
    *(_WORD *)(a1 + 8) |= 0x20u;
    v5 = 0;
    v2->Frozen = 1;
    v2->RootKcb = (_CM_KEY_CONTROL_BLOCK *)a1;
  }
  return(unsigned int)v5;
}

Referenced by: