CmpCompareNewValueDataAgainstKCBCache

INT64 __fastcall CmpCompareNewValueDataAgainstKCBCache(
        INT64 a1,
        const UNICODE_STRING *a2,
        INT64 a3,
        const VOID *a4,
        UINT64 a5){
  int v6; 
  char v8; 
  __int64 v9; 
  unsigned int v10; 
  INT64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  VOID *v14; 
  SIZE_T v15; 
  int v16; 
  bool ValueData; 
  INT64 v19; 
  INT64 v20; 
  INT64 v21; 
  int v22[2]; 
  INT64 v23; 
  LOBYTE(v23) = 0;
  v20 = 0i64;
  LODWORD(v19) = 0;
  v6 = a3;
  v22[1] = 0;
  v21 = 0xFFFFFFFFi64;
  v22[0] = -1;
  v8 = 0;
  if( (int)CmpFindNameInListWithStatus(
              *(_HHIVE **)(a1 + 32),
              (_CHILD_LIST *)(a1 + 96),
              (_UNICODE_STRING *)a2,
              0i64,
              0i64,
              (UINT64 *)&v19) < 0 )
    return 2;
  v9 = (*(__int64(__fastcall **)(_QWORD, _QWORD, int *))(*(_QWORD *)(a1 + 32) + 8i64))(
         *(_QWORD *)(a1 + 32),
         (unsigned int)v19,
         v22);
  v10 = 2;
  v11 = v9;
  if( (*(_BYTE *)(v9 + 16) & 2) == 0 && v6 == *(_DWORD *)(v9 + 12) )
  {
    v12 = *(_DWORD *)(v9 + 4);
    if( (_DWORD)a5 == (v12 & 0x7FFFFFFF) )
    {
      if( (_DWORD)a5 )
      {
        v13 = v12 + 0x80000000;
        if( v12 < 0x80000000 )
          v13 = v12;
        HIDWORD(v19) = v13;
        if( v12 < 0x80000000 )
        {
          v8 = 1;
          ValueData = CmpGetValueData(
                        *(_QWORD *)(a1 + 32),
                        (unsigned int)v19,
                        v11,
                        (UINT64 *)((char *)&v19 + 4),
                        (INT64)&v20,
                        (INT64)&v23,
                        (INT64)&v21);
          v14 = (VOID *)v20;
          if( !ValueData )
            goto LABEL_11;
        }
        else
        {
          v14 = (VOID *)(v11 + 8);
        }
        v15 = (unsigned int)a5;
        LODWORD(v15) = a5 & 0x7FFFFFFF;
        v16 = RtlCompareMemory(v14, (VOID *)a4, v15);
        v10 = (_DWORD)a5 != v16 ? 2 : 0;
LABEL_11:
        if( v14 && v8 )
        {
          if( (_BYTE)v23 == 1 )
            ExFreePoolWithTag(v14, 0);
          else(*(void(__fastcall **)(_QWORD, INT64 *))(*(_QWORD *)(a1 + 32) + 16i64))(*(_QWORD *)(a1 + 32), &v21);
        }
        goto LABEL_13;
      }
      v10 = 0;
    }
  }
LABEL_13:
  (*(void(__fastcall **)(_QWORD, int *, INT64))(*(_QWORD *)(a1 + 32) + 16i64))(*(_QWORD *)(a1 + 32), v22, v11);
  return v10;
}

Referenced by: