CmEnumerateKey

INT64 __fastcall CmEnumerateKey(WCHAR *String){
  __int64 v1; 
  unsigned int v2; 
  unsigned int v3; 
  __int64 v4; 
  LIST_ENTRY *v6; 
  unsigned int v7; 
  _CM_TRANS *CmTrans; 
  INT64 v9; 
  char v10; 
  _CM_KEY_CONTROL_BLOCK *v11; 
  int SubKeyByNumber; 
  __int64 v13; 
  INT64 v14; 
  _CM_KEY_CONTROL_BLOCK *LockedKcb; 
  _CM_KEY_CONTROL_BLOCK *v16; 
  unsigned int v17; 
  INT64 v18; 
  __int64 v19; 
  bool v21; 
  LIST_ENTRY **v22; 
  INT64 v23; 
  INT64 v24; 
  _CM_KEY_CONTROL_BLOCK *ParentKcb; 
  UINT64 ChildCell; 
  int v27[2]; 
  unsigned int Number; 
  unsigned int Number_4; 
  LIST_ENTRY *v30; 
  INT64 a9; 
  INT64 a6; 
  UINT64 *v33; 
  INT64 v34; 
  INT64 a5[2]; 
  struct _PRIVILEGE_SET *v36; 
  __int64 v37; 
  KAPC_STATE ApcState; 
  INT64 v39; 
  unsigned int v40; 
  UINT64 *v41; 
  v4 = v1;
  v6 = 0i64;
  v7 = v2;
  v34 = v39;
  CmTrans = 0i64;
  v33 = v41;
  v27[1] = 0;
  Number_4 = v3;
  Number = v2;
  v37 = v1;
  HIDWORD(ChildCell) = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  a6 = 0i64;
  v27[0] = -1;
  a9 = 0i64;
  *(_OWORD *)a5 = 0i64;
  v30 = 0i64;
  v36 = 0i64;
  CmpInitializeDelayDerefContext(a5);
  CmpAttachToRegistryProcess(&ApcState);
  if( *(_WORD *)(*((_QWORD *)String + 1) + 66i64) )
  {
    do
    {
      v21 = (unsigned int)v6 <= 0xA;
      LODWORD(v6) = (_DWORD)v6 + 1;
      SubKeyByNumber = CmpEnumerateLayeredKey((__int64)String, v7, Number_4, v34, v40, (unsigned int *)v33, &v36, v21);
    }
    while( SubKeyByNumber == -1073741267 );
    v10 = 0;
    goto LABEL_24;
  }
  if( *((_QWORD *)String + 7) || *((_QWORD *)String + 8) )
    CmpLockRegistryExclusive();
  else
    CmpLockRegistry();
  v9 = *((_QWORD *)String + 1);
  v10 = 1;
  if( v4 )
    v11 = *(_CM_KEY_CONTROL_BLOCK **)(v4 + 8);
  else
    v11 = 0i64;
  CmpLockTwoKcbsShared(v11, (_CM_KEY_CONTROL_BLOCK *)v9);
  SubKeyByNumber = CmpPerformKeyBodyDeletionCheck((__int64)String, 0i64);
  if( SubKeyByNumber >= 0 )
  {
    if( !*((_QWORD *)String + 7) && !*((_QWORD *)String + 8)
      || (SubKeyByNumber = CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)String, (_CM_TRANS **)&a9),
          SubKeyByNumber >= 0)
      && (CmTrans = (_CM_TRANS *)a9,
          SubKeyByNumber = CmpPerformKeyBodyDeletionCheck((__int64)String, a9),
          SubKeyByNumber >= 0) )
    {
      v13 = v37;
      if( v37 )
      {
        SubKeyByNumber = CmpPerformKeyBodyDeletionCheck(v37, (__int64)CmTrans);
        if( SubKeyByNumber < 0 )
          goto LABEL_22;
      }
      else if( !CmpVEEnabled || (*(_DWORD *)(v9 + 184) & 0x1000000) == 0 )
      {
        v14 = *(_QWORD *)(v9 + 32);
        if( CmTrans )
        {
          LockedKcb = v11;
          v16 = (_CM_KEY_CONTROL_BLOCK *)v9;
        }
        else
        {
          LockedKcb = 0i64;
          v16 = 0i64;
        }
        SubKeyByNumber = CmpFindSubKeyByNumberEx(
                           (_HHIVE *)v14,
                           *(unsigned int *)(v9 + 40),
                           Number,
                           (UINT64 *)((char *)&ChildCell + 4),
                           v16,
                           LockedKcb,
                           CmTrans,
                           (_CM_KEY_CONTROL_BLOCK **)a5);
        if( SubKeyByNumber >= 0 )
          goto LABEL_16;
        goto LABEL_28;
      }
      v22 = &v30;
      if( !CmTrans )
        v22 = 0i64;
      v23 = v9;
      v24 = (INT64)v11;
      if( !v13 )
        v23 = 0i64;
      if( !v13 )
        v24 = v9;
      SubKeyByNumber = CmpFindSubKeyByNumberFromMergedView(
                         v24,
                         v23,
                         Number,
                         (INT64)CmTrans,
                         (INT64)a5,
                         (INT64)&a6,
                         (INT64)&ChildCell + 4,
                         (INT64)v22,
                         (INT64)&a9);
      if( SubKeyByNumber >= 0 )
      {
        v14 = a6;
LABEL_16:
        v17 = HIDWORD(ChildCell);
        if( HIDWORD(ChildCell) != -1 )
        {
          v18 = (*(__int64(__fastcall **)(INT64, _QWORD, int *))(v14 + 8))(v14, HIDWORD(ChildCell), v27);
          if( CmpKeyNodeNeedsAccessBitUpdate(v14, v18) )
          {
            (*(void(__fastcall **)(__int64, int *))(v14 + 16))(v19, v27);
            HvLockHiveFlusherShared(v14);
            v18 = (*(__int64(__fastcall **)(INT64, _QWORD, int *))(v14 + 8))(v14, v17, v27);
            CmpUpdateKeyNodeAccessBits(v14, v18, v17);
            HvUnlockHiveFlusherShared(v14);
          }
          v6 = v30;
          LODWORD(ParentKcb) = v40;
          SubKeyByNumber = CmpQueryKeyDataFromNode(v14, v18, Number_4, v34, (UINT64)ParentKcb, v33, v30, (INT64)CmTrans);
          if( v18 )
            (*(void(__fastcall **)(INT64, int *))(v14 + 16))(v14, v27);
          v10 = 1;
          goto LABEL_22;
        }
        SubKeyByNumber = -2147483622;
      }
LABEL_28:
      v6 = v30;
    }
  }
LABEL_22:
  CmpUnlockTwoKcbs(v11, (_CM_KEY_CONTROL_BLOCK *)v9);
  if( v6 )
    CmpDereferenceKeyControlBlock((UINT64)v6);
LABEL_24:
  CmpDrainDelayDerefContext((UINT64 **)a5);
  if( v10 )
    CmpUnlockRegistry();
  CmpDetachFromRegistryProcess(&ApcState);
  return(unsigned int)SubKeyByNumber;
}

Referenced by: