CmKeyBodyRemapToVirtual

__int64 __fastcall CmKeyBodyRemapToVirtual(__int64 *a1, char a2, DWORD a3, __int64 a4, _DWORD *a5){
  WCHAR v8; 
  __int64 v9; 
  UINT64 v10; 
  int AccessStateFromSubjectContext; 
  int v12; 
  _UNICODE_STRING *v13; 
  __int64 v15; 
  int v16; 
  __int64 v18; 
  struct _UNICODE_STRING DestinationString; 
  int v20[2]; 
  __int64 v21; 
  struct _UNICODE_STRING *p_DestinationString; 
  int v23; 
  int v24; 
  __int128 v25; 
  _DWORD v26[4]; 
  int v27; 
  __int64 v28; 
  int v29; 
  _QWORD v30[9]; 
  INT64 v31[11]; 
  KAPC_STATE ApcState; 
  struct _SECURITY_SUBJECT_CONTEXT result[5]; 
  __int64 v34[28]; 
  DestinationString = 0i64;
  memset((INT64)result, 0i64);
  memset((INT64)v34, 0i64);
  v20[1] = 0;
  v24 = 0;
  RtlInitUnicodeString(&DestinationString, 0i64, v8);
  memset(&ApcState, 0, sizeof(ApcState));
  memset((INT64)v26, 0i64);
  v29 = -1;
  v30[1] = v30;
  v30[0] = v30;
  memset((INT64)v31, 0i64);
  v9 = *a1;
  v18 = 0i64;
  v10 = *(_QWORD *)(v9 + 8);
  if( *(_WORD *)(v10 + 66)
    || (*(_DWORD *)(v9 + 48) & 0x10) != 0
    || !KCBNeedsVirtualImage(*(_QWORD *)(v9 + 8))
    || (v12 = *(_DWORD *)(v10 + 184), (v12 & 0x800000) == 0)
    || (v12 & 0x20) != 0 )
  {
    AccessStateFromSubjectContext = -1073741790;
    goto LABEL_12;
  }
  CmpAttachToRegistryProcess(&ApcState);
  CmpLockRegistry();
  CmpLockKcbShared((_CM_KEY_CONTROL_BLOCK *)v10);
  AccessStateFromSubjectContext = CmpPerformKeyBodyDeletionCheck(v9, 0i64);
  if( AccessStateFromSubjectContext >= 0 )
  {
    if( (unsigned __int8)CmpReparseToVirtualPath((_CM_KEY_CONTROL_BLOCK *)v10, v13, (_UNICODE_STRING *)a4) )
    {
      CmpUnlockKcb(*(_QWORD *)(*a1 + 8));
      CmpUnlockRegistry();
      v27 = *a5;
      v26[0] = 8;
      v28 = *(_QWORD *)(v9 + 56);
      AccessStateFromSubjectContext = SeCreateAccessStateFromSubjectContext(
                                        a4,
                                        (INT64)result,
                                        (INT64)v34,
                                        a3,
                                        (GENERIC_MAPPING *)((char *)CmKeyObjectType + 76));
      if( AccessStateFromSubjectContext >= 0 )
      {
        v21 = 0i64;
        v16 = 1600;
        v20[0] = 48;
        if( a2 != 1 )
          v16 = 576;
        v23 = v16;
        p_DestinationString = &DestinationString;
        v25 = 0i64;
        if( (int)CmObReferenceObjectByName((__int64)v20, result, a3, v15, 0, (__int64)v26, &v18) >= 0 )
        {
          *a1 = v18;
          HalPutDmaAdapter((PADAPTER_OBJECT)v9);
          AccessStateFromSubjectContext = 0;
        }
        else
        {
          AccessStateFromSubjectContext = -1073741790;
        }
        SeDeleteAccessState((_ACCESS_STATE *)result);
      }
      goto LABEL_11;
    }
    AccessStateFromSubjectContext = -1073741790;
  }
  CmpUnlockKcb(v10);
  CmpUnlockRegistry();
LABEL_11:
  CmpDetachFromRegistryProcess(&ApcState);
LABEL_12:
  if( DestinationString.Buffer )
    RtlFreeAnsiString(&DestinationString);
  CmpCleanupParseContext((__int64)v26, 0);
  return(unsigned int)AccessStateFromSubjectContext;
}

Referenced by: