CmVirtualKCBToRealPath

__int64 __fastcall CmVirtualKCBToRealPath(__int64 a1, _UNICODE_STRING *a2){
  NTSTATUS appended; 
  _UNICODE_STRING *v5; 
  unsigned int v6; 
  int v7; 
  unsigned __int64 v8; 
  unsigned __int16 v9; 
  VOID **PoolWithTag; 
  _UNICODE_STRING Source[2]; 
  _UNICODE_STRING *KeyPath; 

  appended = -1073741670;
  if( !CmpVEEnabled )
    return 3221225485i64;
  KeyPath = 0i64;
  CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)a1, &KeyPath);
  v5 = KeyPath;
  if( KeyPath )
  {
    v6 = 0;
    v7 = 5;
    v8 = 0i64;
    while( KeyPath->Buffer[v8 / 2] != 92 || --v7 )
    {
      v8 = 2i64 * ++v6;
      if( v8 >= KeyPath->Length )
      {
        appended = -1073741811;
        goto LABEL_14;
      }
    }
    v9 = KeyPath->Length + 2 * (9 - v6);
    PoolWithTag = ExAllocatePoolWithTag(1ui64, KeyPath->Length + 2 * (9 - v6), 1649298755i64);
    a2->Buffer = (wchar_t *)PoolWithTag;
    if( PoolWithTag )
    {
      a2->MaximumLength = v9;
      a2->Length = 0;
      Source[0] = *v5;
      Source[0].Length = 18;
      appended = RtlAppendUnicodeStringToString(a2, Source);
      if( appended < 0
        || (Source[0].Length = v5->Length - 2 * v6,
            Source[0].Buffer += v6,
            appended = RtlAppendUnicodeStringToString(a2, Source),
            appended < 0) )
      {
        RtlFreeAnsiString(a2);
      }
    }
LABEL_14:
    CmpFreeTransientPoolWithTag(v5, 0x624E4D43ui64);
  }
  return(unsigned int)appended;
}

Referenced by: