CmpLoadKeyCommon

__int64 __fastcall CmpLoadKeyCommon(
        ULONG_PTR BugCheckParameter2,
        __int64 *a2,
        __int16 a3,
        __int64 a4,
        __int64 a5,
        struct _KEVENT *a6,
        char a7,
        volatile signed __int64 **a8,
        char a9,
        char a10,
        _OWORD *a11){
  __int64 LowerLayerKcb; 
  int v15; 
  int v16; 
  __int64 v17; 
  unsigned int v18; 
  INT64 v19; 
  int v20; 
  WCHAR v21; 
  INT64 v22; 
  int v23; 
  volatile INT64 *v24; 
  volatile signed __int64 **v25; 
  _QWORD *v26; 
  _QWORD *v27; 
  __int64 v28; 
  __int64 v29; 
  struct _LOOKASIDE_LIST_EX *v30; 
  EVENT_DESCRIPTOR *v31; 
  __int64 v32; 
  UINT64 KcbCacheSize; 
  INT64 KcbCacheSizea; 
  ULONG_PTR BugCheckParameter2a; 
  volatile signed __int64 **v38; 
  _KEVENT *UserEvent; 
  KAPC_STATE ApcState; 
  *(_DWORD *)(BugCheckParameter2 + 160) |= 0x20u;
  LowerLayerKcb = 0i64;
  BugCheckParameter2a = 0i64;
  UserEvent = a6;
  v38 = a8;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_QWORD *)(BugCheckParameter2 + 4208) = KeGetCurrentThread();
  v15 = a3 & 0x10;
  if( (a3 & 0x10) != 0 )
  {
    v16 = *(_DWORD *)(BugCheckParameter2 + 4152) | 0x20;
    *(_DWORD *)(BugCheckParameter2 + 4152) = v16;
    if( (a3 & 0x20) != 0 )
      *(_DWORD *)(BugCheckParameter2 + 4152) = v16 | 0x40;
  }
  *(_DWORD *)(BugCheckParameter2 + 4152) |= 1u;
  LockShutdownShared();
  LOCK_HIVE_LOAD();
  CmpLockRegistryFreezeAware(1u);
  if( a4 && !v15 )
  {
    if( CmpIsKeyDeletedForKeyBody(a4, 0i64) )
    {
      v18 = -1073741444;
      LODWORD(KcbCacheSize) = 16;
LABEL_8:
      v19 = v18;
LABEL_9:
      SetFailureLocation((INT64)a11, 0i64, 29i64, v19, KcbCacheSize);
LABEL_22:
      CmpUnlockRegistry();
      UNLOCK_HIVE_LOAD();
      CmpAttachToRegistryProcess(&ApcState);
      CmpDestroyHive((PVOID)BugCheckParameter2);
      CmpDetachFromRegistryProcess(&ApcState);
      goto LABEL_39;
    }
    LOBYTE(v17) = a7;
    v20 = CmpJoinClassOfTrust(BugCheckParameter2, *(_QWORD *)(*(_QWORD *)(a4 + 8) + 32i64), v17);
    v18 = v20;
    if( v20 < 0 )
    {
      LODWORD(KcbCacheSize) = 32;
LABEL_12:
      v19 = (unsigned int)v20;
      goto LABEL_9;
    }
    v20 = CmpVEAddHiveToSIDMappingTable(BugCheckParameter2, (__int64)a2, v21);
    v18 = v20;
    if( v20 < 0 )
    {
      LODWORD(KcbCacheSize) = 48;
      goto LABEL_12;
    }
  }
  if( a5 )
  {
    v20 = CmpPerformKeyBodyDeletionCheck(a5, 0i64);
    v18 = v20;
    if( v20 < 0 )
    {
      LODWORD(KcbCacheSize) = 64;
      goto LABEL_12;
    }
    LowerLayerKcb = *(_QWORD *)(a5 + 8);
    if( (*(_DWORD *)(LowerLayerKcb + 184) & 0x40000) == 0 )
    {
      v18 = -1073741811;
      LODWORD(KcbCacheSize) = 80;
      goto LABEL_8;
    }
  }
  CmpUnlockRegistry();
  LOBYTE(v22) = a9;
  LODWORD(KcbCacheSize) = 512;
  v23 = CmpLinkHiveToMaster(
          (_UNICODE_STRING *)a2[2],
          (VOID *)a2[1],
          (_CMHIVE *)BugCheckParameter2,
          v22,
          KcbCacheSize,
          v15 != 0,
          UserEvent,
          (VOID *)a2[4],
          (_CM_KEY_CONTROL_BLOCK *)LowerLayerKcb,
          (_CM_KEY_CONTROL_BLOCK **)&BugCheckParameter2a,
          0);
  v18 = v23;
  if( v23 < 0 )
  {
    LODWORD(KcbCacheSizea) = 96;
    SetFailureLocation((INT64)a11, 0i64, 29i64, (unsigned int)v23, KcbCacheSizea);
    CmpLockRegistryFreezeAware(1u);
    goto LABEL_22;
  }
  v24 = (volatile INT64 *)BugCheckParameter2a;
  if( (a3 & 0x800) != 0 )
  {
    CmpReferenceKeyControlBlockUnsafe((volatile INT64 *)BugCheckParameter2a);
    v25 = v38;
    *v38 = v24;
  }
  else
  {
    v25 = v38;
  }
  CmpLockRegistryFreezeAware(1u);
  if( v15 )
  {
    CmpReferenceKeyControlBlockUnsafe(*(volatile INT64 **)(BugCheckParameter2 + 2928));
    *v25 = *(volatile signed __int64 **)(BugCheckParameter2 + 2928);
  }
  CmpLockHiveListExclusive();
  v26 = (_QWORD *)qword_140D2D918;
  v27 = (_QWORD *)(BugCheckParameter2 + 1600);
  if( *(__int64 **)qword_140D2D918 != &CmpHiveListHead )
    __fastfail(3u);
  *v27 = &CmpHiveListHead;
  *(_QWORD *)(BugCheckParameter2 + 1608) = v26;
  *v26 = v27;
  qword_140D2D918 = BugCheckParameter2 + 1600;
  CmpUnlockHiveList();
  CmpUnlockRegistry();
  CmpAttachToRegistryProcess(&ApcState);
  CmpRecheckHiveVolumePolicy(BugCheckParameter2);
  CmpDetachFromRegistryProcess(&ApcState);
  CmpDereferenceKeyControlBlockUnsafe(v24);
  UNLOCK_HIVE_LOAD();
  if( (a3 & 0x110) == 0 )
  {
    CmpInitCmRM(BugCheckParameter2, a10);
    *(_DWORD *)(BugCheckParameter2 + 4152) |= 8u;
  }
  if( a9 )
  {
    CmpAttachToRegistryProcess(&ApcState);
    CmpFlushHive(BugCheckParameter2, 4, v31);
    CmpDetachFromRegistryProcess(&ApcState);
  }
  if( !v15 )
    CmpAddToHiveFileList(BugCheckParameter2, v28, v29, v30);
  v32 = *(_QWORD *)(BugCheckParameter2 + 4192);
  if( v32 )
  {
    TmEnableCallbacks(
      *(PKRESOURCEMANAGER *)(v32 + 56),
      (PTM_RM_NOTIFICATION)CmKtmNotification,
      *(PVOID *)(BugCheckParameter2 + 4192));
    CmRmFinalizeRecovery(*(_QWORD *)(BugCheckParameter2 + 4192));
  }
  CmpTrimHive(BugCheckParameter2);
  LOCK_HIVE_LOAD();
  *(_DWORD *)(BugCheckParameter2 + 160) &= ~0x20u;
  *(_QWORD *)(BugCheckParameter2 + 4208) = 0i64;
  UNLOCK_HIVE_LOAD();
  v18 = 0;
LABEL_39:
  UnlockShutdown();
  if( !CmpProfileLoaded && !CmpWasSetupBoot )
  {
    CmpProfileLoaded = 1;
    CmpSetGlobalQuotaAllowed();
  }
  return v18;
}

Referenced by: