CmpCloseKeyObject

VOID __stdcall CmpCloseKeyObject(_EPROCESS *Process, PVOID Object, UINT64 ProcessHandleCount, UINT64 SystemHandleCount){
  __int64 v4; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  char IsKeyDeletedForKeyBody; 
  UINT64 v10; 
  _UNICODE_STRING *v11; 
  UINT64 v12; 
  _CM_NOTIFY_BLOCK *v13; 
  __int64 v14; 
  _LIST_ENTRY DelayedDeref; 
  _LIST_ENTRY ExternalDeferredPostAsync; 
  LARGE_INTEGER v17[2]; 
  __int128 v18; 
  v4 = 0i64;
  ExternalDeferredPostAsync = 0i64;
  DelayedDeref = 0i64;
  *(_OWORD *)&v17[0].LowPart = 0i64;
  v18 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    EtwGetKernelTraceTimestamp(v17, 0x20000ui64);
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    {
      if( Object )
        v4 = *((_QWORD *)Object + 1);
    }
  }
  if( SystemHandleCount <= 1 && *(_DWORD *)Object == 1803104306 && *((_QWORD *)Object + 2) )
  {
    ExternalDeferredPostAsync.Blink = &ExternalDeferredPostAsync;
    ExternalDeferredPostAsync.Flink = &ExternalDeferredPostAsync;
    DelayedDeref.Blink = &DelayedDeref;
    DelayedDeref.Flink = &DelayedDeref;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    CmpLockRegistry();
    v8 = *((_QWORD *)Object + 1);
    ExAcquirePushLockSharedEx(v8 + 48, 0i64);
    _InterlockedIncrement((volatile signed __int32 *)(v8 + 56));
    IsKeyDeletedForKeyBody = CmpIsKeyDeletedForKeyBody((__int64)Object, 0i64);
    v10 = *((_QWORD *)Object + 1);
    if( IsKeyDeletedForKeyBody )
    {
      CmpUnlockKcb(v10);
      CmpUnlockRegistry();
    }
    else
    {
      ExAcquirePushLockExclusiveEx(*(_QWORD *)(v10 + 32) + 1672i64, 0i64);
      v13 = (_CM_NOTIFY_BLOCK *)*((_QWORD *)Object + 2);
      if( v13 && v13->PostList.Flink != &v13->PostList )
        CmpPostNotify(v13, v11, v12, 267i64, 0, &DelayedDeref, &ExternalDeferredPostAsync);
      v14 = *(_QWORD *)(*((_QWORD *)Object + 1) + 32i64);
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v14 + 1672), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(v14 + 1672));
      KeAbPostRelease((PVOID)(v14 + 1672));
      CmpUnlockKcb(*((_QWORD *)Object + 1));
      CmpUnlockRegistry();
      CmpDelayedDerefKeys(&DelayedDeref);
      CmpSignalDeferredPosts(&ExternalDeferredPostAsync);
    }
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(Process) = 27;
    (*(void(__fastcall **)(_EPROCESS *, LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      Process,
      v17,
      0i64,
      0i64,
      v4,
      0i64);
  }
}

Referenced by: