CmpCreateTombstone

INT64 __fastcall CmpCreateTombstone(INT64 a1, INT64 a2){
  __int64 v3; 
  INT64 KcbAtLayerHeight; 
  INT64 v5; 
  INT64 v6; 
  INT16 i; 
  __int16 v8; 
  _HSTORAGE_TYPE v9; 
  size_t v10; 
  unsigned int v11; 
  char *v12; 
  unsigned int v13; 
  int v14; 
  size_t v15; 
  INT64 v16; 
  _LIST_ENTRY *SecurityDescriptorForKcbStack; 
  PVOID v18; 
  __int64 v19; 
  unsigned __int16 v20; 
  __int64 v21; 
  _HV_GET_CELL_CONTEXT Context; 
  _HV_GET_CELL_CONTEXT CellAddressContext; 
  VOID *CellAddress; 

  CellAddressContext = 0i64;
  Context = 0i64;
  CellAddress = 0i64;
  HvpGetCellContextInitialize(&CellAddressContext);
  HvpGetCellContextInitialize(&Context);
  KcbAtLayerHeight = CmpGetKcbAtLayerHeight(a2, *(_WORD *)(v3 + 2));
  v5 = *(_QWORD *)(KcbAtLayerHeight + 72);
  v6 = 0i64;
  for( i = *(_WORD *)(KcbAtLayerHeight + 66); i >= 0; i = v8 - 1 )
  {
    v6 = CmpGetKcbAtLayerHeight(a2, i);
    if( *(_DWORD *)(v6 + 40) != -1 )
      break;
  }
  v9 = *(_DWORD *)(v6 + 40) >> 31;
  if( *(int *)(v5 + 40) < 0 )
    v9 = 1;
  HvLockHiveFlusherShared(*(_QWORD *)(KcbAtLayerHeight + 32));
  v10 = *(unsigned __int16 *)(*(_QWORD *)(KcbAtLayerHeight + 80) + 24i64) + 76;
  v11 = HvAllocateCell(*(_QWORD *)(KcbAtLayerHeight + 32), v10, v9, &CellAddress, &CellAddressContext);
  v12 = (char *)CellAddress;
  v13 = v11;
  if( v11 == -1 )
  {
    v14 = -1073741670;
  }
  else
  {
    memset(CellAddress, 0i64, v10);
    *(_DWORD *)v12 = 27502;
    v12[12] = CmpGetPhaseAccessBit();
    v12[13] = v12[13] & 0xFC | 1;
    if( (**(_DWORD **)(KcbAtLayerHeight + 80) & 1) != 0 )
      *((_WORD *)v12 + 1) = 32;
    *(_QWORD *)(v12 + 4) = 0i64;
    *((_DWORD *)v12 + 4) = *(_DWORD *)(v5 + 40);
    *((_DWORD *)v12 + 7) = -1;
    *((_DWORD *)v12 + 8) = -1;
    *((_DWORD *)v12 + 10) = -1;
    *((_DWORD *)v12 + 11) = -1;
    *((_DWORD *)v12 + 12) = -1;
    *((_WORD *)v12 + 37) = 0;
    *((_DWORD *)v12 + 13) &= 0xFFF0FFFF;
    v12[55] = 0;
    *((_DWORD *)v12 + 13) &= 0xFF0FFFFF;
    v15 = *(unsigned __int16 *)(*(_QWORD *)(KcbAtLayerHeight + 80) + 24i64);
    *((_WORD *)v12 + 36) = v15;
    memmove(v12 + 76, (const VOID *)(*(_QWORD *)(KcbAtLayerHeight + 80) + 26i64), v15);
    SecurityDescriptorForKcbStack = CmpGetSecurityDescriptorForKcbStack(a2, 0i64, v16);
    CmLockHiveSecurityExclusive(*(_EX_PUSH_LOCK **)(KcbAtLayerHeight + 32));
    v14 = CmpAssignSecurityDescriptor(
            *(_QWORD *)(KcbAtLayerHeight + 32),
            v13,
            (INT64)v12,
            SecurityDescriptorForKcbStack,
            0);
    CmUnlockHiveSecurity(*(_QWORD *)(KcbAtLayerHeight + 32));
    if( v14 >= 0 )
    {
      if( HvMarkCellDirty(*(PVOID *)(v5 + 32), (PVOID)*(unsigned int *)(v5 + 40), 0) )
      {
        if( CmpAddSubKey(*(_QWORD *)(v5 + 32), *(unsigned int *)(v5 + 40), v13) )
        {
          CmpIncrementKcbSequenceNumber(KcbAtLayerHeight);
          *(_DWORD *)(KcbAtLayerHeight + 40) = v13;
          v13 = -1;
          CmpRebuildKcbCacheFromNode(v18, (__int64)v12, 0i64, 0);
          v19 = (*(__int64(__fastcall **)(_QWORD, _QWORD, _HV_GET_CELL_CONTEXT *))(*(_QWORD *)(v5 + 32) + 8i64))(
                  *(_QWORD *)(v5 + 32),
                  *(unsigned int *)(v5 + 40),
                  &Context);
          CmpUpdateKeyNodeAccessBits(*(_HHIVE **)(v5 + 32), (_CM_KEY_NODE *)v19, *(unsigned int *)(v5 + 40));
          v20 = 2 * *((_WORD *)v12 + 36);
          if( (v12[2] & 0x20) == 0 )
            v20 = *((_WORD *)v12 + 36);
          if( (unsigned __int16)*(_DWORD *)(v19 + 52) < (unsigned int)v20 )
            *(_WORD *)(v19 + 52) = v20;
          CmpIncrementKcbSequenceNumber(v5);
          v21 = *(_QWORD *)(v5 + 32);
          *(_WORD *)(v5 + 176) = *(_WORD *)(v19 + 52);
          (*(void(__fastcall **)(__int64, _HV_GET_CELL_CONTEXT *))(v21 + 16))(v21, &Context);
          CmpCleanUpSubKeyInfo(v5, 1);
          v14 = 0;
        }
        else
        {
          v14 = -1073741670;
        }
      }
      else
      {
        v14 = -1073741443;
      }
    }
  }
  if( v12 )
    (*(void(__fastcall **)(_QWORD, _HV_GET_CELL_CONTEXT *))(*(_QWORD *)(KcbAtLayerHeight + 32) + 16i64))(
      *(_QWORD *)(KcbAtLayerHeight + 32),
      &CellAddressContext);
  if( v13 != -1 )
    CmpFreeKeyByCell(*(_QWORD *)(KcbAtLayerHeight + 32), v13, 0);
  HvUnlockHiveFlusherShared(*(_QWORD *)(KcbAtLayerHeight + 32));
  return(unsigned int)v14;
}

Referenced by: