CmpFlushBackupHive

NTSTATUS __stdcall CmpFlushBackupHive(UINT64 Index){
  __int64 v1; 
  unsigned int v2; 
  CMP_OFFSET_ARRAY *v3; 
  unsigned int v4; 
  __int64 v5; 
  wchar_t *v6; 
  WCHAR v7; 
  WCHAR v8; 
  void *v9; 
  NTSTATUS inited; 
  WCHAR v11; 
  UINT64 v12; 
  void *v13; 
  _QWORD *v14; 
  void *v15; 
  char FileInformation[3]; 
  __int16 ObjectInformation; 
  int v19; 
  int v20; 
  INT64 v21; 
  struct _STRING Destination; 
  UINT64 FileLength; 
  PVOID P; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  KAPC_STATE ApcState; 
  INT64 result[54]; 
  char v29; 
  v1 = (unsigned int)Index;
  P = 0i64;
  v21 = 0i64;
  FileLength = 0i64;
  DestinationString = 0i64;
  v2 = 0;
  *(_QWORD *)&Destination.Length = 0x800000i64;
  v3 = 0i64;
  FileInformation[1] = 1;
  v4 = 0;
  IoStatusBlock = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset((INT64)result, 0i64);
  v5 = 25 * v1;
  Destination.Buffer = &v29;
  v6 = CmpMachineHiveList[v5 + 6];
  RtlInitUnicodeString(&DestinationString, L"\\SystemRoot\\System32\\Config\\RegBack\\", v7);
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  RtlInitUnicodeString(&DestinationString, CmpMachineHiveList[v5], v8);
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  RtlAppendUnicodeToString((UNICODE_STRING *)&Destination, (PWCHAR)L".OLD");
  v9 = (void *)*((_QWORD *)v6 + 195);
  if( !v9 )
    return -1073741431;
  inited = CmpCmdRenameHive(v9, 0i64, (_UNICODE_STRING *)&Destination, 0i64, 1u);
  if( inited >= 0 )
  {
    Destination.Length -= 8;
    *((_QWORD *)v6 + 195) = 0i64;
    inited = CmpInitBackupHive((__int64)v6, CmpMachineHiveList[v5], v11);
    if( inited < 0 )
      goto LABEL_14;
    CmpAttachToRegistryProcess(&ApcState);
    CmpLockRegistry();
    if( CmpDoIdleProcessing )
    {
      ExAcquirePushLockExclusiveEx((UINT64)(v6 + 36), 0i64);
      inited = HvSnapshotHiveToOffsetArray((INT64)v6, &v21, (CHAR **)&FileLength, (UINT64 *)((char *)&v21 + 4));
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 9, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)v6 + 9);
      KeAbPostRelease(v6 + 36);
      v2 = v21;
      v3 = (CMP_OFFSET_ARRAY *)FileLength;
      v4 = HIDWORD(v21);
    }
    else
    {
      inited = -1073741431;
    }
    CmpUnlockRegistry();
    KiUnstackDetachProcess(&ApcState, 0i64);
    if( inited < 0 )
      goto LABEL_14;
    inited = CmpWriteOffsetArrayToFile(v12, (CMP_OFFSET_ARRAY *)v2, (UINT64)v3, (PVOID)v4);
    CmpFreeOffsetArray(v2, v3);
    if( inited < 0
      || (v13 = (void *)*((_QWORD *)v6 + 195),
          ObjectInformation = 0,
          ZwSetInformationObject(v13, ObjectHandleFlagInformation, &ObjectInformation, 2ui64),
          ZwClose(*((HANDLE *)v6 + 195)),
          *((_QWORD *)v6 + 195) = 0i64,
          FileInformation[0] = 0,
          inited = CmpCmdHiveOpen(
                     (const UNICODE_STRING *)&Destination,
                     0,
                     FileInformation,
                     (ULONG_PTR *)&P,
                     0x1100001u,
                     0,
                     0i64,
                     0i64,
                     result),
          inited < 0) )
    {
LABEL_14:
      v15 = (void *)*((_QWORD *)v6 + 195);
      if( v15 )
      {
        LOWORD(v20) = 0;
        ZwSetInformationObject(v15, ObjectHandleFlagInformation, &v20, 2ui64);
        ZwClose(*((HANDLE *)v6 + 195));
        *((_QWORD *)v6 + 195) = 0i64;
      }
      if( CmpCmdRenameHive(v9, 0i64, (_UNICODE_STRING *)&Destination, 0i64, 1u) >= 0 )
        *((_QWORD *)v6 + 195) = v9;
    }
    else
    {
      v14 = P;
      *((_QWORD *)v6 + 195) = *((_QWORD *)P + 192);
      v14[192] = 0i64;
      CmpAttachToRegistryProcess(&ApcState);
      CmpDestroyHive(v14);
      KiUnstackDetachProcess(&ApcState, 0i64);
      ZwSetInformationFile(v9, &IoStatusBlock, &FileInformation[1], 1ui64, FileDispositionInformation);
      LOWORD(v19) = 0;
      ZwSetInformationObject(v9, ObjectHandleFlagInformation, &v19, 2ui64);
      ZwClose(v9);
    }
  }
  return inited;
}

Referenced by: