CmRealKCBToVirtualPath

INT64 __fastcall CmRealKCBToVirtualPath(INT64 a1, __m128i *a2, INT64 a3, UNICODE_STRING *a4){
  char v6; 
  _UNICODE_STRING *v8; 
  NTSTATUS VirtualizationID; 
  unsigned int v10; 
  __m128i v11; 
  wchar_t *v12; 
  unsigned __int16 Length; 
  wchar_t *PoolWithTag; 
  wchar_t *v15; 
  UNICODE_STRING v16; 
  UNICODE_STRING Source; 
  UNICODE_STRING v18; 
  v6 = 0;
  Source = 0i64;
  v16 = 0i64;
  if( !CmpVEEnabled )
    return 3221225485i64;
  v8 = CmpConstructName((_CM_KEY_CONTROL_BLOCK *)a1);
  if( !v8 )
    return 3221225626i64;
  VirtualizationID = CmpGetVirtualizationID(&Source);
  if( VirtualizationID >= 0 )
  {
    v10 = v8->Length + Source.Length + 38;
    if( a2 )
    {
      v11 = *a2;
      *(_QWORD *)&v16.Length = a2->m128i_i64[0];
      v12 = (wchar_t *)_mm_srli_si128(v11, 8).m128i_u64[0];
      v16.Buffer = v12;
      if( v12 )
      {
        Length = v16.Length;
        if( v16.Length )
        {
          if( *v12 )
          {
            if( *v12 == 92 )
            {
              Length = v16.Length - 2;
              v16.Buffer = v12 + 1;
              v16.Length -= 2;
            }
            if( Length )
            {
              v10 += Length + 2;
              v6 = 1;
            }
          }
        }
      }
    }
    PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v10, 0x624E4D43ui64);
    a4->Buffer = PoolWithTag;
    if( PoolWithTag )
    {
      a4->MaximumLength = v10;
      a4->Length = 0;
      VirtualizationID = RtlAppendUnicodeToString(a4, (PWCHAR)L"\\Registry\\User\\");
      if( VirtualizationID < 0 )
        goto LABEL_23;
      VirtualizationID = RtlAppendUnicodeStringToString(a4, &Source);
      if( VirtualizationID < 0 )
        goto LABEL_23;
      VirtualizationID = RtlAppendUnicodeToString(a4, (PWCHAR)L"\\VirtualStore");
      if( VirtualizationID < 0
        || (v15 = v8->Buffer + 9,
            *(_QWORD *)&v18.Length = *(_QWORD *)&v8->Length,
            v18.Buffer = v15,
            v18.Length = v8->Length - 18,
            VirtualizationID = RtlAppendUnicodeStringToString(a4, &v18),
            VirtualizationID < 0)
        || v6
        && ((VirtualizationID = RtlAppendUnicodeToString(a4, (PWCHAR)L"\\"), VirtualizationID < 0)
         || (VirtualizationID = RtlAppendUnicodeStringToString(a4, &v16), VirtualizationID < 0)) )
      {
LABEL_23:
        RtlFreeAnsiString(a4);
      }
    }
    else
    {
      VirtualizationID = -1073741670;
    }
  }
  CmpFreeTransientPoolWithTag(v8, 0x624E4D43ui64);
  RtlFreeAnsiString(&Source);
  return(unsigned int)VirtualizationID;
}

Referenced by: