CmpAddToHiveFileList

__int64 __fastcall CmpAddToHiveFileList(__int64 a1, __int64 a2, __int64 a3, struct _LOOKASIDE_LIST_EX *a4){
  void *v5; 
  void *v6; 
  NTSTATUS v7; 
  unsigned int v8; 
  __int16 *v9; 
  int v10; 
  UINT64 DataSize; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 v15; 
  UINT64 ReturnLength; 
  void *KeyHandle; 
  DestinationString = 0i64;
  LODWORD(ReturnLength) = 0;
  v15 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyHandle = 0i64;
  if( !CmpHiveFileListHandle )
  {
    RtlInitUnicodeString(&DestinationString, L"\\registry\\machine\\system\\currentcontrolset\\control\\hivelist", a3);
    LODWORD(DataSize) = 1;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, DataSize, 0i64);
    if( v7 < 0 )
      return(unsigned int)v7;
    if( _InterlockedCompareExchange64(
           (volatile signed __int64 *)&CmpHiveFileListHandle,
           (signed __int64)KeyHandle,
           0i64) )
    {
      ZwClose(KeyHandle);
    }
  }
  CmpAllocateTransientPoolWithTag((_HHIVE *)1, 0x202ui64, 0x62714D43ui64, (_CHILD_LIST *)a4);
  v6 = v5;
  if( !v5 )
    return(unsigned int)-1073741801;
  if( (*(_DWORD *)(a1 + 160) & 1) != 0 )
  {
    v9 = &v15;
    v10 = 2;
    goto LABEL_6;
  }
  v7 = ZwQueryObject(*(PVOID *)(a1 + 1536), ObjectNameInformation, v5, 0x200ui64, &ReturnLength);
  v8 = ReturnLength - 16;
  LODWORD(ReturnLength) = ReturnLength - 16;
  if( v7 >= 0 )
  {
    v9 = (__int16 *)*((_QWORD *)v6 + 1);
    v9[(unsigned __int64)v8 >> 1] = 0;
    v10 = ReturnLength + 2;
LABEL_6:
    LODWORD(DataSize) = v10;
    LODWORD(ReturnLength) = v10;
    v7 = ZwSetValueKey(CmpHiveFileListHandle, (UNICODE_STRING *)(a1 + 1848), 0i64, 1ui64, v9, DataSize);
  }
  CmSiFreeMemory((PPRIVILEGE_SET)v6);
  return(unsigned int)v7;
}

Referenced by: