CmpCloseKeyObject

VOID __stdcall CmpCloseKeyObject(EPROCESS *Process, VOID *Object, UINT64 ProcessHandleCount, UINT64 SystemHandleCount){
  __int64 v4; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  UINT8 IsKeyDeletedForKeyBody; 
  _CM_KEY_CONTROL_BLOCK *v10; 
  INT64 v11; 
  UINT8 v12; 
  CM_NOTIFY_BLOCK *v13; 
  _EX_PUSH_LOCK *v14; 
  LIST_ENTRY *ExternalDeferredPostAsync; 
  _LIST_ENTRY DelayedDeref; 
  _LIST_ENTRY DeferredPostAsync; 
  _LARGE_INTEGER TimeStamp[2]; 
  __int128 v19; 

  v4 = 0i64;
  DeferredPostAsync = 0i64;
  DelayedDeref = 0i64;
  *(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
  v19 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    {
      if( Object )
        v4 = *((_QWORD *)Object + 1);
    }
  }
  if( SystemHandleCount <= 1 && *(_DWORD *)Object == 1803104306 && *((_QWORD *)Object + 2) )
  {
    DeferredPostAsync.Blink = &DeferredPostAsync;
    DeferredPostAsync.Flink = &DeferredPostAsync;
    DelayedDeref.Blink = &DelayedDeref;
    DelayedDeref.Flink = &DelayedDeref;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    CmpLockRegistry();
    v8 = *((_QWORD *)Object + 1);
    ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v8 + 48), 0i64);
    _InterlockedIncrement((volatile signed __int32 *)(v8 + 56));
    IsKeyDeletedForKeyBody = CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)Object, 0i64);
    v10 = (_CM_KEY_CONTROL_BLOCK *)*((_QWORD *)Object + 1);
    if( IsKeyDeletedForKeyBody )
    {
      CmpUnlockKcb(v10);
      CmpUnlockRegistry();
    }
    else
    {
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&v10->KeyHash.KeyHive[1].Cluster, 0i64);
      v13 = (CM_NOTIFY_BLOCK *)*((_QWORD *)Object + 2);
      if( v13 && v13->PostList.Flink != &v13->PostList )
      {
        LOBYTE(ExternalDeferredPostAsync) = 0;
        CmpPostNotify(v13, v11, v12, (LIST_ENTRY *)0x10B, ExternalDeferredPostAsync);
      }
      v14 = *(_EX_PUSH_LOCK **)(*((_QWORD *)Object + 1) + 32i64);
      if( (_InterlockedExchangeAdd64(&v14[209]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v14 + 209);
      KeAbPostRelease(&v14[209]);
      CmpUnlockKcb(*((_CM_KEY_CONTROL_BLOCK **)Object + 1));
      CmpUnlockRegistry();
      CmpDelayedDerefKeys(&DelayedDeref);
      CmpSignalDeferredPosts(&DeferredPostAsync);
    }
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(Process) = 27;
    (*(void(__fastcall **)(EPROCESS *, _LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      Process,
      TimeStamp,
      0i64,
      0i64,
      v4,
      0i64);
  }
}

Referenced by: