CmpVirtualBranchIsReplicated

INT64 __fastcall CmpVirtualBranchIsReplicated(
        _CM_KEY_CONTROL_BLOCK *RootKCB,
        _UNICODE_STRING *Path,
        UINT8 *ParentReplicated){
  INT64 result; 
  char *v7; 
  char *KeyHive; 
  CHAR PathByName; 
  INT64 v10; 
  CHAR v11; 
  __int64 v12; 
  bool v13; 
  UINT8 v14; 
  unsigned __int16 v15; 
  unsigned __int16 v16; 
  bool v17; 
  INT64 v18; 
  UNICODE_STRING v19; 
  UINT64 v20; 
  int v21; 
  int v22; 
  char *v23; 
  v21 = -1;
  result = 0i64;
  LODWORD(v20) = 0;
  v22 = 0;
  v18 = 0i64;
  v23 = 0i64;
  *ParentReplicated = 0;
  v7 = 0i64;
  v19 = 0i64;
  if( RootKCB )
  {
    if( !Path->Length )
    {
      v17 = CmpVEEnabled && (*((_DWORD *)RootKCB + 46) & 0x1000000) != 0;
      LOBYTE(result) = v17;
      return result;
    }
    KeyHive = (char *)RootKCB->KeyHash.KeyHive;
  }
  else
  {
    LODWORD(result) = CmpGetCmHiveFromVirtualPath(Path, &v23);
    if( (int)result < 0 )
    {
LABEL_18:
      LOBYTE(result) = 0;
      return result;
    }
    v7 = (char *)CmpMasterHive;
    KeyHive = v23;
  }
  result = CmpBlockTwoHiveWrites((__int64)v7, (__int64)KeyHive, 1);
  if( (int)result < 0 )
    goto LABEL_18;
  PathByName = CmpFindPathByName((INT64)RootKCB, (__m128i *)Path, &v19, &v20, &v18);
  v10 = v18;
  v11 = PathByName;
  if( v18 && (v12 = (*(__int64(__fastcall **)(INT64, _QWORD, int *))(v18 + 8))(v18, (unsigned int)v20, &v21)) != 0 )
  {
    if( v11 )
    {
      if( !CmpVEEnabled || (*(_WORD *)(v12 + 2) & 0x100) == 0 )
        v11 = 0;
    }
    else
    {
      if( !CmpVEEnabled || (v13 = (*(_WORD *)(v12 + 2) & 0x100) == 0, v14 = 1, v13) )
        v14 = 0;
      v15 = 0;
      v16 = v19.Length >> 1;
      *ParentReplicated = v14;
      if( v16 )
      {
        while( v19.Buffer[v15] != 92 )
        {
          if( ++v15 >= v16 )
            goto LABEL_16;
        }
        *ParentReplicated = 0;
      }
    }
LABEL_16:
    (*(void(__fastcall **)(INT64, int *))(v10 + 16))(v10, &v21);
  }
  else
  {
    v11 = 0;
  }
  CmpUnblockTwoHiveWrites(v7, KeyHive);
  LOBYTE(result) = v11;
  return result;
}

Referenced by:

CmpVEExecuteRealStoreParseLogic
CmpVEExecuteVirtualStoreParseLogic