CmpLinkHiveToMaster

INT64 __fastcall CmpLinkHiveToMaster(
        _UNICODE_STRING *LinkName,
        VOID *RootDirectory,
        _CMHIVE *CmHive,
        INT64 Allocate,
        UINT64 KcbCacheSize,
        UINT8 AppHive,
        _KEVENT *UserEvent,
        VOID *SecurityDescriptor,
        _CM_KEY_CONTROL_BLOCK *LowerLayerKcb,
        _CM_KEY_CONTROL_BLOCK **RootKeyControlBlock,
        UINT8 RegLockHeld){
  _UNICODE_STRING *v12; 
  char v13; 
  int v14; 
  char v15; 
  int v16; 
  int v17; 
  int v18; 
  NTSTATUS v19; 
  _CM_KEY_CONTROL_BLOCK **v20; 
  VOID *PoolWithTag; 
  UINT64 v22; 
  UINT8 v23; 
  UINT8 v24; 
  PRKEVENT v25; 
  _CM_KEY_CONTROL_BLOCK **v26; 
  __int128 v28; 
  __int128 v29; 
  __int128 v30; 
  __int128 v31; 
  PVOID *Object; 
  PVOID *Objecta; 
  IRP *Objectb; 
  char v35; 
  char v36; 
  HANDLE Handle; 
  PVOID v38; 
  _UNICODE_STRING *v39; 
  _CM_KEY_CONTROL_BLOCK *v40; 
  VOID *v41; 
  VOID *v42; 
  PRKEVENT Event; 
  _CM_KEY_CONTROL_BLOCK **v44; 
  _QWORD a1[2]; 
  int v46[2]; 
  VOID *v47; 
  _UNICODE_STRING *v48; 
  int v49; 
  int v50; 
  VOID *v51; 
  __int64 v52; 
  _DWORD result[10]; 
  int v54; 
  _CMHIVE *v55; 
  _CM_KEY_CONTROL_BLOCK *v56; 
  int v57; 
  _QWORD v58[9]; 
  INT64 v59[2]; 
  __int128 v60; 
  __int128 v61; 
  __int128 v62; 
  __int128 v63; 
  KAPC_STATE ApcState; 
  _OWORD *v65; 
  Event = UserEvent;
  v42 = SecurityDescriptor;
  v40 = LowerLayerKcb;
  v44 = RootKeyControlBlock;
  v41 = RootDirectory;
  v12 = 0i64;
  v39 = LinkName;
  v46[1] = 0;
  v50 = 0;
  v13 = 0;
  Handle = 0i64;
  v35 = 0;
  v36 = Allocate;
  *(_OWORD *)a1 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset((INT64)result, 0i64);
  v57 = -1;
  v58[1] = v58;
  v58[0] = v58;
  memset((INT64)v59, 0i64);
  CmpInitializeDelayDerefContext(a1);
  v14 = *((_DWORD *)CmHive + 40);
  v15 = 1;
  if( (v14 & 0x20) == 0 )
  {
    v35 = 1;
    *((_DWORD *)CmHive + 40) = v14 | 0x20;
    *((_QWORD *)CmHive + 526) = KeGetCurrentThread();
  }
  v16 = CmpInitializeKcbCache((__int64)CmHive, KcbCacheSize);
  v17 = v16;
  if( v16 < 0 )
  {
    LODWORD(Object) = 16;
    SetFailureLocation((INT64)v65, 0i64, 30i64, (unsigned int)v16, (INT64)Object);
LABEL_40:
    v15 = 0;
    goto LABEL_29;
  }
  v18 = 67;
  v55 = CmHive;
  if( AppHive )
    v18 = 2115;
  result[0] = v18;
  if( v36 )
    v54 = -1;
  else
    v54 = *(_DWORD *)(*((_QWORD *)CmHive + 8) + 36i64);
  v56 = v40;
  v47 = v41;
  v48 = v39;
  v51 = v42;
  v52 = 0i64;
  v46[0] = 48;
  v49 = 576;
  v19 = ObOpenObjectByName((__int64)v46, (__int64)CmKeyObjectType, 0, 0i64, 0x2001Fu, (__int64)result, &Handle);
  v17 = v19;
  if( v19 < 0 )
  {
    LODWORD(Objecta) = 32;
    SetFailureLocation((INT64)v65, 0i64, 30i64, (unsigned int)v19, (INT64)Objecta);
    v13 = 0;
    v28 = v60;
    v65[22] = *(_OWORD *)v59;
    v29 = v61;
    v65[23] = v28;
    v30 = v62;
    v65[24] = v29;
    v31 = v63;
    v65[25] = v30;
    v65[26] = v31;
    goto LABEL_40;
  }
  v38 = 0i64;
  ObReferenceObjectByHandle(Handle, 0, (POBJECT_TYPE)CmKeyObjectType, 0, &v38, 0i64);
  v20 = (_CM_KEY_CONTROL_BLOCK **)v38;
  ZwClose(Handle);
  CmpAttachToRegistryProcess(&ApcState);
  if( !RegLockHeld )
    CmpLockRegistry();
  v12 = CmpConstructName(v20[1]);
  if( !RegLockHeld )
    CmpUnlockRegistry();
  if( !v12
    || (PoolWithTag = ExAllocatePoolWithTag(PagedPool, v12->Length, 0x70684D43ui64),
        (*((_QWORD *)CmHive + 232) = PoolWithTag) == 0i64) )
  {
    v17 = -1073741670;
    goto LABEL_44;
  }
  *((_WORD *)CmHive + 924) = 0;
  *((_WORD *)CmHive + 925) = v12->Length;
  RtlUnicodeStringCopy((UNICODE_STRING *)((char *)CmHive + 1848), v12);
  *((_BYTE *)CmHive + 141) = 0;
  *((_DWORD *)CmHive + 417) = _InterlockedIncrement(&CmHiveIdentity);
  if( !RegLockHeld )
    CmpLockRegistry();
  if( AppHive )
  {
    CmpReferenceKeyControlBlockUnsafe((volatile INT64 *)v20[1]);
    v25 = Event;
    *((_QWORD *)CmHive + 366) = v20[1];
    if( v25 )
    {
      KeResetEvent(v25, v22, v23, v24, Objectb);
      CmpRecordUnloadEventForHive((__int64)CmHive, v25);
    }
  }
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    CmpEtwDumpKcb(v20[1], 0x21u);
  CmpDetachFromRegistryProcess(&ApcState);
  if( !RegLockHeld )
    CmpUnlockRegistry();
  v26 = v44;
  if( v44 )
  {
    CmpReferenceKeyControlBlockUnsafe((volatile INT64 *)v20[1]);
    *v26 = v20[1];
  }
  HalPutDmaAdapter((PADAPTER_OBJECT)v38);
  if( AppHive )
    *((_BYTE *)CmHive + 2936) = 1;
  v13 = 1;
  v15 = 0;
  v17 = 0;
LABEL_29:
  v20 = 0i64;
  if( v17 >= 0 || !v13 )
    goto LABEL_30;
  CmpAttachToRegistryProcess(&ApcState);
LABEL_44:
  if( !RegLockHeld )
    CmpLockRegistry();
  CmpRemoveHiveFromNamespace(CmHive, v20[1]);
  CmpDrainDelayDerefContext((UINT64 **)a1);
  if( !RegLockHeld )
    CmpUnlockRegistry();
  if( v15 )
    CmpDetachFromRegistryProcess(&ApcState);
LABEL_30:
  if( v12 )
    CmpFreeTransientPoolWithTag(v12, 0x624E4D43ui64);
  if( v20 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v20);
  if( v35 )
  {
    *((_DWORD *)CmHive + 40) &= ~0x20u;
    *((_QWORD *)CmHive + 526) = 0i64;
  }
  CmpCleanupParseContext((__int64)result, RegLockHeld);
  return(unsigned int)v17;
}

Referenced by: