CmCallbackGetKeyObjectIDEx

NTSTATUS __stdcall CmCallbackGetKeyObjectIDEx(
        LARGE_INTEGER *Cookie,
        PVOID Object,
        UINT64 *ObjectID,
        UNICODE_STRING **ObjectName,
        UINT64 Flags){
  UINT64 v6; 
  NTSTATUS started; 
  _UNICODE_STRING *KeyPath; 
  INT64 v10[2]; 
  PPRIVILEGE_SET Privileges[2]; 
  KAPC_STATE ApcState; 
  KeyPath = 0i64;
  *(_OWORD *)v10 = 0i64;
  WORD1(v10[0]) = -1;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_OWORD *)Privileges = 0i64;
  if( !Object || *(_DWORD *)Object != 1803104306 || !Cookie || (_DWORD)Flags )
    goto LABEL_20;
  v6 = *((_QWORD *)Object + 1);
  if( ObjectID )
    *ObjectID = v6;
  if( !ObjectName )
  {
    started = 0;
    goto LABEL_15;
  }
  if( (v6 & 1) == 0 )
  {
    CmpAttachToRegistryProcess(&ApcState);
    CmpLockRegistry();
    started = CmpStartKcbStackForTopLayerKcb((INT64)v10, v6);
    if( started >= 0 )
    {
      CmpLockKcbStackShared((INT64)v10);
      if( *(_QWORD *)(v6 + 80) && CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)v6, &KeyPath) >= 0 )
      {
        started = 0;
        *ObjectName = KeyPath;
      }
      else
      {
        started = -1073741670;
      }
      CmpUnlockKcbStack((__int64)v10);
    }
    CmpUnlockRegistry();
    KiUnstackDetachProcess(&ApcState, 0i64);
  }
  else
  {
LABEL_20:
    started = -1073741811;
  }
LABEL_15:
  if( Privileges[1] )
    CmSiFreeMemory(Privileges[1]);
  return started;
}

Referenced by: