CmDumpKey

NTSTATUS __stdcall CmDumpKey(_CM_KEY_BODY *KeyBody, PVOID FileHandle){
  KPROCESSOR_MODE v2; 
  KPROCESSOR_MODE v3; 
  _CM_KEY_CONTROL_BLOCK *KeyControlBlock; 
  char v7; 
  NTSTATUS v8; 
  INT64 v9; 
  _HHIVE *KeyHive; 
  CMP_OFFSET_ARRAY *v11; 
  unsigned int v12; 
  UINT64 v13; 
  _HHIVE *v14; 
  HANDLE FileHandlea; 
  UINT64 FileLength; 
  INT64 v18; 
  UINT64 v19; 
  v3 = v2;
  LODWORD(v19) = 0;
  LODWORD(v18) = 0;
  FileLength = 0i64;
  CmpLockRegistry();
  KeyControlBlock = KeyBody->KeyControlBlock;
  v7 = 1;
  if( KeyControlBlock->KeyHash.KeyHive == (_HHIVE *)CmpMasterHive )
  {
    v8 = -1073741790;
LABEL_23:
    CmpUnlockRegistry();
    return v8;
  }
  ExAcquirePushLockSharedEx((UINT64)&KeyControlBlock->KcbPushlock, 0i64);
  _InterlockedAdd((volatile signed __int32 *)&KeyControlBlock->56, 1u);
  v8 = CmpPerformKeyBodyDeletionCheck((__int64)KeyBody, 0i64);
  if( v8 < 0 )
  {
LABEL_22:
    CmpUnlockKcb((UINT64)KeyControlBlock);
    goto LABEL_23;
  }
  if( (*((_DWORD *)KeyControlBlock + 46) & 0x40000) == 0 )
  {
    v8 = -1073741811;
    goto LABEL_22;
  }
  if( KeyControlBlock->LayerHeight )
  {
    CmpUnlockKcb((UINT64)KeyControlBlock);
    CmpUnlockRegistry();
    return CmSaveKey((__int64)KeyBody, (__int64)FileHandle, 5, v3);
  }
  else
  {
    ExAcquirePushLockExclusiveEx((UINT64)&KeyControlBlock->KeyHash.KeyHive->FlusherLock, 0i64);
    ExAcquirePushLockSharedEx((UINT64)&KeyControlBlock->KeyHash.KeyHive[1].ViewMap.ProcessTuple, 0i64);
    LOBYTE(v9) = v3;
    LODWORD(FileHandlea) = 3;
    v8 = CmpDoAccessCheckOnSubtree(
           (INT64)KeyControlBlock->KeyHash.KeyHive,
           KeyControlBlock->KeyHash.KeyCell,
           v9,
           131097i64,
           (INT64)FileHandlea);
    ExReleasePushLockEx((UINT64)&KeyControlBlock->KeyHash.KeyHive[1].ViewMap.ProcessTuple, 0i64);
    if( v8 < 0 )
      goto LABEL_19;
    v8 = HvSnapshotHiveToOffsetArray((INT64)KeyControlBlock->KeyHash.KeyHive, &v18, (CHAR **)&FileLength, &v19);
    if( v8 < 0 )
    {
      v12 = v18;
      v11 = (CMP_OFFSET_ARRAY *)FileLength;
    }
    else
    {
      KeyHive = KeyControlBlock->KeyHash.KeyHive;
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&KeyHive->FlusherLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)&KeyHive->FlusherLock);
      KeAbPostRelease(&KeyHive->FlusherLock);
      CmpUnlockKcb((UINT64)KeyControlBlock);
      CmpUnlockRegistry();
      v11 = (CMP_OFFSET_ARRAY *)FileLength;
      v7 = 0;
      v12 = v18;
      v8 = CmpWriteOffsetArrayToFile(v13, (CMP_OFFSET_ARRAY *)(unsigned int)v18, FileLength, (PVOID)(unsigned int)v19);
      if( v8 >= 0 )
        v8 = 0;
    }
    if( v11 )
      CmpFreeOffsetArray(v12, v11);
    if( v7 )
    {
LABEL_19:
      v14 = KeyControlBlock->KeyHash.KeyHive;
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&v14->FlusherLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)&v14->FlusherLock);
      KeAbPostRelease(&v14->FlusherLock);
      goto LABEL_22;
    }
  }
  return v8;
}

Referenced by: