CmpCreateEmptyHiveClone

INT64 __fastcall CmpCreateEmptyHiveClone(INT64 *a1, INT64 a2){
  __int64 v4; 
  __int64 v5; 
  int v6; 
  _QWORD *v7; 
  unsigned int v8; 
  __int64 v9; 
  _QWORD *v10; 
  __int64 v11; 
  int v12; 
  int v14; 
  LODWORD(v4) = CmpAllocate(0x12E8ui64, 0, 0x30314D43ui64);
  v5 = v4;
  if( v4 )
  {
    CmpHiveInitialize(v4);
    v7 = (_QWORD *)(a2 + 1536);
    v8 = 0;
    *(_DWORD *)(v5 + 4152) = *(_DWORD *)(a2 + 4152);
    v9 = 2i64;
    while( 1 )
    {
      if( *v7 )
      {
        LOBYTE(v14) = 0;
        v6 = ObDuplicateObject(PsInitialSystemProcess, *v7, 0i64, v5 + 8 * (v8 + 192i64), 0, 512, 2, v14);
        if( v6 < 0 )
          break;
      }
      ++v8;
      ++v7;
      if( v8 >= 6 )
      {
        v10 = (_QWORD *)(v5 + 1800);
        *(_DWORD *)(v5 + 1784) = *(_DWORD *)(a2 + 1784);
        *(_QWORD *)(v5 + 1792) = *(_QWORD *)(a2 + 1792);
        do
        {
          *v10 = *(_QWORD *)((char *)v10 + a2 - v5);
          ++v10;
          --v9;
        }
        while( v9 );
        *(_QWORD *)(v5 + 4176) = *(_QWORD *)(a2 + 4176);
        *(_QWORD *)(v5 + 4184) = *(_QWORD *)(a2 + 4184);
        *(_QWORD *)(v5 + 4224) = *(_QWORD *)(a2 + 4224);
        v11 = *(_QWORD *)(a2 + 4832);
        if( v11 )
        {
          if( _InterlockedIncrement64((volatile signed __int64 *)(v11 + 24)) <= 1 )
            __fastfail(0xEu);
          *(_QWORD *)(v5 + 4832) = *(_QWORD *)(a2 + 4832);
        }
        HvHiveStartEmptyClone(v5, a2);
        v6 = v12;
        if( v12 >= 0 )
        {
          *a1 = v5;
          v5 = 0i64;
          v6 = 0;
        }
        break;
      }
    }
    if( v5 )
      CmpDestroyHive((PVOID)v5);
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)v6;
}

Referenced by: