CmpVEExecuteCreateLogic
INT64 __fastcall CmpVEExecuteCreateLogic(
INT64 a1,
INT64 a2,
__m128i *a3,
INT64 a4,
CHAR a5,
INT64 a6,
INT64 a7,
INT64 a8,
INT64 a9){
int v12;
_UNICODE_STRING *v13;
_UNICODE_STRING *v14;
WCHAR v15;
WCHAR v16;
void *v17;
VOID *v19;
VOID *v20;
struct _UNICODE_STRING DestinationString;
LOBYTE(v19) = 0;
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)a3);
if( *(_WORD *)(a1 + 66) )
goto LABEL_2;
if( (*(_DWORD *)(a8 + 24) & 0x10) != 0 )
goto LABEL_2;
v13 = (_UNICODE_STRING *)(a4 + 32);
if( !KCBNeedsVirtualImage(a1) )
goto LABEL_2;
if( (*(_DWORD *)(a8 + 160) & 1) == 0 )
{
CmpAttachToRegistryProcess((KAPC_STATE *)(a8 + 168));
*(_DWORD *)(a8 + 160) |= 1u;
}
if( (unsigned __int8)CmpReparseToVirtualPath((_CM_KEY_CONTROL_BLOCK *)a1, v14, v13) )
{
ExFreePoolWithTag(DestinationString.Buffer, 0);
RtlInitUnicodeString(&DestinationString, 0i64, v15);
v12 = CmRealKCBToVirtualPath(a1, a3, (INT64)v13, &DestinationString);
if( v12 >= 0 )
{
v17 = *(void **)(a9 + 8);
if( v17 )
ExFreePoolWithTag(v17, 0);
*(struct _UNICODE_STRING *)a9 = DestinationString;
RtlInitUnicodeString(&DestinationString, 0i64, v16);
*(_DWORD *)a8 |= 8u;
v12 = 260;
}
goto LABEL_19;
}
if( (*(_DWORD *)(a1 + 184) & 0x20) != 0
|| (unsigned __int8)CmpDoAccessCheckOnKCB(
(_CM_KEY_CONTROL_BLOCK *)a1,
(_CM_TRANS *)a7,
(unsigned int)a6 | 4,
a5,
v19) )
{
LABEL_2:
v12 = -1073741199;
goto LABEL_19;
}
if( !(unsigned __int8)CmpDoAccessCheckOnKCB((_CM_KEY_CONTROL_BLOCK *)a1, (_CM_TRANS *)a7, 0x20019ui64, a5, v20)
|| (v12 = CmpCheckAdminAccess((unsigned int)a6 | 4, (PVOID)(*(_QWORD *)(a1 + 88) + 32i64), (UINT8 *)v13), v12 >= 0) )
{
v12 = -1073741790;
}
LABEL_19:
if( DestinationString.Buffer )
ExFreePoolWithTag(DestinationString.Buffer, 0);
return(unsigned int)v12;
}Referenced by:
CmpDoParseKey