CmSaveMergedKeys
__int64 __fastcall CmSaveMergedKeys(__int64 a1, __int64 a2, __int64 a3, char a4){
__int64 v4;
__int64 v5;
_CMHIVE *v6;
_CMHIVE *v7;
__int64 v8;
_DWORD *v9;
UINT64 v10;
char v11;
int v12;
_CM_KEY_CONTROL_BLOCK *v13;
_CM_KEY_CONTROL_BLOCK *v14;
_GUID *v15;
unsigned int v16;
INT64 v17;
INT64 v18;
unsigned int v19;
__int64 v20;
__int64 v21;
NTSTATUS v22;
const _GUID *v23;
INT64 v25;
INT64 v26;
CHAR v27;
INT64 v28;
INT64 v29;
UINT64 v30;
char v31;
_CM_KEY_CONTROL_BLOCK *a3_7;
_CM_KEY_CONTROL_BLOCK *v34;
unsigned int v35;
int v36[2];
int v37[2];
INT64 v38;
__int64 v39;
_CM_KEY_BODY *KeyBody;
_CM_KEY_BODY *v41;
UUID HiveTmUuid;
UUID Uuid;
_EVENT_DATA_DESCRIPTOR v44;
__int64 *v45;
__int64 v46;
KeyBody = (_CM_KEY_BODY *)a1;
v39 = a3;
v37[1] = 0;
v36[1] = 0;
v4 = *(_QWORD *)(a1 + 8);
v5 = *(_QWORD *)(a2 + 8);
v37[0] = -1;
v36[0] = -1;
Uuid = 0i64;
a3_7 = (_CM_KEY_CONTROL_BLOCK *)v4;
v6 = 0i64;
HiveTmUuid = 0i64;
v7 = *(_CMHIVE **)(v4 + 32);
v8 = 0i64;
v9 = 0i64;
v10 = *(_QWORD *)(v5 + 32);
v11 = 0;
LODWORD(v38) = *(_DWORD *)(v4 + 40);
LODWORD(v4) = *(_DWORD *)(v5 + 40);
v34 = (_CM_KEY_CONTROL_BLOCK *)v5;
v41 = (_CM_KEY_BODY *)a2;
v35 = v4;
v31 = 0;
v12 = CmpUuidCreate(&Uuid);
if( v12 < 0 )
goto LABEL_41;
v12 = CmpUuidCreate(&HiveTmUuid);
if( v12 < 0 )
goto LABEL_41;
if( v10 == *(_QWORD *)&CmpMasterHive || v7 == *(_CMHIVE **)&CmpMasterHive )
{
if( *(&stru_140C00F40 + 1148) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x400000000000i64) )
{
v39 = 0x1000000i64;
v45 = &v39;
v46 = 8i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4592,
(unsigned __int8 *)byte_140022D90,
0i64,
v23,
3u,
&v44);
}
v12 = -1073741790;
goto LABEL_37;
}
if( (_CMHIVE *)v10 == v7 )
{
v12 = -1073741811;
LABEL_41:
v13 = v34;
goto LABEL_42;
}
CmpLockRegistry();
v13 = v34;
v14 = a3_7;
CmpLockTwoKcbsShared(a3_7, v34);
v31 = 1;
if( a3_7->LayerHeight || v34->LayerHeight )
{
CmpLogUnsupportedOperation(19);
v12 = -1073741822;
goto LABEL_43;
}
if( CmpIsKeyDeletedForKeyBody(KeyBody, 0i64) || CmpIsKeyDeletedForKeyBody(v41, 0i64) )
{
v12 = -1073741444;
goto LABEL_43;
}
if( (v7->Hive.HiveFlags & 2) != 0 && v7->Hive.DirtyCount
|| (*(_DWORD *)(v10 + 160) & 2) != 0 && *(_DWORD *)(v10 + 104) )
{
v12 = -1073741811;
goto LABEL_43;
}
v6 = CmpCreateTemporaryHive(&Uuid, &HiveTmUuid, v15);
if( !v6 )
{
v12 = -1073741670;
goto LABEL_43;
}
v12 = CmpBlockTwoHiveWrites((_CMHIVE *)v10, v7, 0);
if( v12 >= 0 )
{
v11 = 6;
CmLockHiveSecurityShared((_EX_PUSH_LOCK *)v7);
v16 = v38;
LOBYTE(v17) = a4;
LODWORD(v25) = 3;
v12 = CmpDoAccessCheckOnSubtree((INT64)v7, (unsigned int)v38, v17, 131097i64, v25);
CmUnlockHiveSecurity((int)v7);
if( v12 < 0 )
goto LABEL_42;
CmLockHiveSecurityShared((_EX_PUSH_LOCK *)v10);
LOBYTE(v18) = a4;
LODWORD(v26) = 3;
v12 = CmpDoAccessCheckOnSubtree(v10, v35, v18, 131097i64, v26);
CmUnlockHiveSecurity(v10);
if( v12 < 0 )
goto LABEL_42;
HvLockHiveFlusherExclusive((INT64)v6);
LODWORD(v30) = 0;
v11 = 7;
v19 = CmpCopyKeyPartial((UINT64)v7, (unsigned int)v38, (UINT64)v6, 0xFFFFFFFFui64, 6, v27, v30);
if( v19 == -1
|| (LODWORD(v28) = 0,
v6->Hive.BaseBlock->RootCell = v19,
!CmpCopySyncTree((UINT64)v7, v16, (UINT64)v6, v19, 2, v28)) )
{
v12 = -1073741670;
LABEL_42:
v14 = a3_7;
goto LABEL_43;
}
HvUnlockHiveFlusherExclusive((INT64)v7);
v11 = 5;
v9 = (_DWORD *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(v10 + 8))(v10, v35, v36);
if( !v9 )
goto LABEL_25;
v20 = (__int64)v6->Hive.GetCellRoutine(&v6->Hive, v19, (_HV_GET_CELL_CONTEXT *)v37);
v8 = v20;
if( v20 && CmpMergeKeyValues(v10, v21, v9, v6, v19, v20) )
{
(*(void(__fastcall **)(UINT64, int *))(v10 + 16))(v10, v36);
v6->Hive.ReleaseCellRoutine(&v6->Hive, (_HV_GET_CELL_CONTEXT *)v37);
LODWORD(v29) = 2;
if( CmpCopySyncTree(v10, v35, (UINT64)v6, v19, 2, v29) )
{
HvUnlockHiveFlusherExclusive(v10);
HvUnlockHiveFlusherExclusive((INT64)v6);
v13 = v34;
v11 = 0;
v14 = a3_7;
CmpUnlockTwoKcbs(a3_7, v34);
CmpUnlockRegistry();
v6->FileHandles[2] = (void *)v39;
v31 = 0;
v22 = HvWriteExternal(&v6->Hive);
v6->FileHandles[2] = 0i64;
v12 = v22;
goto LABEL_43;
}
LABEL_25:
v12 = -1073741670;
goto LABEL_41;
}
v12 = -1073741670;
LABEL_37:
if( v9 )
(*(void(__fastcall **)(UINT64, int *))(v10 + 16))(v10, v36);
if( v8 )
v6->Hive.ReleaseCellRoutine(&v6->Hive, (_HV_GET_CELL_CONTEXT *)v37);
goto LABEL_41;
}
LABEL_43:
if( (v11 & 4) != 0 )
HvUnlockHiveFlusherExclusive(v10);
if( (v11 & 2) != 0 )
HvUnlockHiveFlusherExclusive((INT64)v7);
if( (v11 & 1) != 0 )
HvUnlockHiveFlusherExclusive((INT64)v6);
if( v31 )
{
CmpUnlockTwoKcbs(v14, v13);
CmpUnlockRegistry();
}
if( v6 )
CmpDestroyHive(v6);
return(unsigned int)v12;
}Referenced by:
NtSaveMergedKeys