CmAddLogForAction

NTSTATUS __stdcall CmAddLogForAction(CM_KCB_UOW *UoW){
  unsigned int v1; 
  unsigned int v2; 
  VOID **v4; 
  unsigned int v5; 
  _CM_TRANS *Transaction; 
  size_t v7; 
  size_t v8; 
  unsigned int TransState; 
  _CM_KEY_CONTROL_BLOCK *KeyControlBlock; 
  _UNICODE_STRING *v11; 
  UoWActionType ActionType; 
  int v13; 
  bool v14; 
  _HHIVE *KeyHive; 
  _CELL_DATA *(__fastcall *GetCellRoutine)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  __int64 v17; 
  unsigned int v18; 
  unsigned __int16 v19; 
  unsigned int v20; 
  unsigned int Length; 
  unsigned int v22; 
  VOID **PoolWithTag; 
  UoWActionType v24; 
  int v25; 
  INT64 v26; 
  wchar_t *v27; 
  size_t v28; 
  VOID *v29; 
  char *v30; 
  BOOLEAN v31; 
  PLOG_FILE_OBJECT *v32; 
  int v33; 
  VOID **v34; 
  VOID **v35; 
  unsigned int DescriptorLength; 
  char *v38; 
  _DWORD *p_Cell; 
  size_t v40; 
  size_t v41; 
  __int64 v42; 
  unsigned __int16 v43; 
  __int64 v44; 
  wchar_t *v45; 
  int v46[2]; 
  VOID *Src; 
  _UNICODE_STRING *KeyPath; 
  __int64 v49; 
  int v50[2]; 
  _CLS_LSN LastLsn; 
  void *CmRm[10]; 
  unsigned int ValueCell; 
  unsigned int pcbInfoBuffer; 
  size_t Size; 
  INT64 v56; 

  pcbInfoBuffer = v1;
  v2 = 0;
  v46[1] = 0;
  v50[1] = 0;
  v46[0] = -1;
  v4 = 0i64;
  v50[0] = -1;
  v5 = 0;
  Transaction = UoW->Transaction;
  v7 = 0;
  LastLsn.ullOffset = 0i64;
  v8 = 0;
  v56 = 0i64;
  ValueCell = -1;
  TransState = Transaction->TransState;
  pcbInfoBuffer = 0;
  Size = 0;
  v49 = 0i64;
  if( (TransState & 0x80u) != 0 )
    return 0;
  KeyControlBlock = UoW->KeyControlBlock;
  CmRm[0] = KeyControlBlock->KeyHash.KeyHive[2].Storage[1].FreeDisplay[7].Display.Buffer;
  if( !*((_QWORD *)CmRm[0] + 12) || !*(_QWORD *)&Transaction->Trans.0 || UoW->ActionType == UoWIsolation )
    return 0;
  KeyPath = 0i64;
  CmpConstructNameWithStatus(KeyControlBlock, &KeyPath);
  v11 = KeyPath;
  if( KeyPath )
  {
    ActionType = UoW->ActionType;
    if( ActionType == UoWAddThisKey || ActionType == UoWDeleteThisKey )
    {
      DescriptorLength = UoW->KeyControlBlock->CachedSecurity->DescriptorLength;
    }
    else
    {
      if( ActionType <= UoWDeleteChildKey )
        goto LABEL_20;
      if( ActionType <= UoWDeleteValue )
      {
        v13 = 80;
        v14 = (unsigned int)(ActionType - 4) <= 1;
        KeyHive = UoW->KeyControlBlock->KeyHash.KeyHive;
        GetCellRoutine = KeyHive->GetCellRoutine;
        if( v14 )
        {
          ValueCell = UoW->NewValueCell;
          v17 = (__int64)GetCellRoutine(KeyHive, ValueCell, (_HV_GET_CELL_CONTEXT *)v46);
          v56 = v17;
          if( v17 )
          {
            v18 = *(_DWORD *)(v17 + 4);
            pcbInfoBuffer = v18;
            if( v18 >= 0x80000000 )
            {
              v18 += 0x80000000;
              pcbInfoBuffer = v18;
            }
            v13 = v18 + 80;
            Size = v18;
            if( v18 >= 0xFFFFFFB0 )
            {
              v33 = -1073741675;
LABEL_42:
              if( v17 )
                UoW->KeyControlBlock->KeyHash.KeyHive->ReleaseCellRoutine(
                  UoW->KeyControlBlock->KeyHash.KeyHive,
                  (_HV_GET_CELL_CONTEXT *)v46);
              if( v4 )
                ExFreePoolWithTag(v4, 0);
              goto LABEL_46;
            }
            goto LABEL_15;
          }
        }
        else
        {
          ValueCell = UoW->VolatileKeyCell;
          v17 = (__int64)GetCellRoutine(KeyHive, ValueCell, (_HV_GET_CELL_CONTEXT *)v46);
          v56 = v17;
          if( v17 )
          {
LABEL_15:
            v19 = *(_WORD *)(v17 + 2);
            if( (*(_BYTE *)(v17 + 16) & 1) != 0 )
              v19 *= 2;
            v7 = v19;
            v20 = v13;
            v2 = v19 + v13;
            goto LABEL_18;
          }
        }
LABEL_69:
        v33 = -1073741670;
LABEL_46:
        CmpFreeTransientPoolWithTag(v11, 0x624E4D43ui64);
        return v33;
      }
      if( ActionType != UoWSetSecurityDescriptor )
      {
        if( ActionType == UoWSetKeyUserFlags || ActionType == UoWSetLastWriteTime )
        {
          v2 = 56;
          goto LABEL_20;
        }
        if( ActionType != UoWRenameOldSubKey )
        {
LABEL_20:
          Length = v11->Length;
          v22 = Length + v2;
          if( v22 >= Length )
          {
            PoolWithTag = ExAllocatePoolWithTag(1ui64, v22, 538987843i64);
            v4 = PoolWithTag;
            if( !PoolWithTag )
            {
LABEL_74:
              v33 = -1073741670;
              goto LABEL_39;
            }
            *((_DWORD *)PoolWithTag + 1) = v22;
            *((_DWORD *)PoolWithTag + 2) = 1;
            *((_OWORD *)PoolWithTag + 1) = UoW->Transaction->KtmUow;
            *((_WORD *)PoolWithTag + 16) = v11->Length;
            *((_WORD *)PoolWithTag + 17) = v11->MaximumLength;
            v24 = UoW->ActionType;
            if( v24 == UoWAddThisKey || v24 == UoWDeleteThisKey )
            {
              *((_DWORD *)PoolWithTag + 3) = (v24 != UoWAddThisKey) + 1;
              *((_DWORD *)PoolWithTag + 12) = UoW->StorageType;
              PoolWithTag[5] = PoolWithTag + 8;
              memmove(PoolWithTag + 8, v11->Buffer, v11->Length);
              v38 = (char *)v4 + v11->Length + 64;
              v4[7] = v38;
              p_Cell = &UoW->KeyControlBlock->CachedSecurity->Cell;
              v40 = p_Cell[6];
            }
            else
            {
              if( v24 <= UoWDeleteChildKey )
                goto LABEL_34;
              if( v24 <= UoWDeleteValue )
              {
                Src = 0i64;
                v25 = 0;
                KeyPath = (_UNICODE_STRING *)0xFFFFFFFFi64;
                LOBYTE(pcbInfoBuffer) = 0;
                if( v24 == UoWSetValueNew )
                {
                  *((_DWORD *)v4 + 3) = 3;
                }
                else
                {
                  LOBYTE(v25) = v24 != UoWSetValueExisting;
                  *((_DWORD *)v4 + 3) = v25 + 4;
                }
                v26 = v56;
                *((_DWORD *)v4 + 16) = *(_DWORD *)(v56 + 12);
                v4[5] = v4 + 10;
                memmove(v4 + 10, v11->Buffer, v11->Length);
                v27 = (wchar_t *)((char *)v4 + v11->Length + 80);
                v4[7] = v27;
                if( (*(_BYTE *)(v26 + 16) & 1) != 0 )
                  CmpCopyCompressedName(v27, v7, (PWCHAR)(v26 + 20), *(unsigned __int16 *)(v26 + 2));
                else
                  memmove(v27, (const VOID *)(v26 + 20), v7);
                *((_WORD *)v4 + 25) = v7;
                *((_WORD *)v4 + 24) = v7;
                if( UoW->ActionType != UoWDeleteValue )
                {
                  *((_DWORD *)v4 + 17) = v5;
                  if( CmpGetValueData(
                         UoW->KeyControlBlock->KeyHash.KeyHive,
                         ValueCell,
                         (_CM_KEY_VALUE *)v26,
                         &Size,
                         &Src,
                         (unsigned __int8 *)&pcbInfoBuffer,
                         (_HV_GET_CELL_CONTEXT *)&KeyPath) )
                  {
                    v28 = Size;
                    v29 = Src;
                    v30 = (char *)v27 + v7;
                    v4[9] = v30;
                    memmove(v30, v29, v28);
                    if( (_BYTE)pcbInfoBuffer == 1 )
                      ExFreePoolWithTag(Src, 0);
                    else
                      UoW->KeyControlBlock->KeyHash.KeyHive->ReleaseCellRoutine(
                        UoW->KeyControlBlock->KeyHash.KeyHive,
                        (_HV_GET_CELL_CONTEXT *)&KeyPath);
                    goto LABEL_34;
                  }
                  goto LABEL_74;
                }
                *((_DWORD *)v4 + 17) = 0;
                v4[9] = 0i64;
LABEL_34:
                *(_DWORD *)v4 = HvBufferCheckSum(v4, *((unsigned int *)v4 + 1));
                v31 = ClfsLsnInvalid((const CLFS_LSN *)&UoW->Transaction->StartLsn);
                v32 = (PLOG_FILE_OBJECT *)CmRm[0];
                v33 = CmpTransWriteLog((_CM_RM *)CmRm[0], v4, *((unsigned int *)v4 + 1), v31 != 0 ? 2 : 0, &LastLsn);
                if( v33 >= 0 && ClfsLsnInvalid((const CLFS_LSN *)&UoW->Transaction->StartLsn) )
                  UoW->Transaction->StartLsn = LastLsn.ullOffset;
                pcbInfoBuffer = 120;
                v34 = ExAllocatePoolWithTag(1ui64, 0x78ui64, 538987843i64);
                v35 = v34;
                if( v34 )
                {
                  ClfsGetLogFileInformation(v32[11], (PCLFS_INFORMATION)v34, &pcbInfoBuffer);
                  ExFreePoolWithTag(v35, 0);
                }
                goto LABEL_39;
              }
              if( v24 != UoWSetSecurityDescriptor )
              {
                switch( v24 )
                {
                  case UoWSetKeyUserFlags:
                    *((_DWORD *)PoolWithTag + 3) = 6;
                    PoolWithTag[5] = PoolWithTag + 7;
                    memmove(PoolWithTag + 7, v11->Buffer, v11->Length);
                    *((_DWORD *)v4 + 12) = UoW->VolatileKeyCell;
                    break;
                  case UoWSetLastWriteTime:
                    *((_DWORD *)PoolWithTag + 3) = 7;
                    PoolWithTag[5] = PoolWithTag + 7;
                    memmove(PoolWithTag + 7, v11->Buffer, v11->Length);
                    v4[6] = UoW->ChildKCB;
                    break;
                  case UoWRenameOldSubKey:
                    *((_DWORD *)PoolWithTag + 3) = 9;
                    PoolWithTag[5] = PoolWithTag + 8;
                    memmove(PoolWithTag + 8, v11->Buffer, v11->Length);
                    v44 = v49;
                    v45 = (wchar_t *)((char *)v4 + v11->Length + 64);
                    v4[7] = v45;
                    if( (*(_BYTE *)(v44 + 2) & 0x20) != 0 )
                      CmpCopyCompressedName(v45, v8, (PWCHAR)(v44 + 76), *(unsigned __int16 *)(v44 + 72));
                    else
                      memmove(v45, (const VOID *)(v44 + 76), v8);
                    *((_WORD *)v4 + 25) = v8;
                    *((_WORD *)v4 + 24) = v8;
                    break;
                }
                goto LABEL_34;
              }
              *((_DWORD *)PoolWithTag + 3) = 8;
              PoolWithTag[5] = PoolWithTag + 8;
              memmove(PoolWithTag + 8, v11->Buffer, v11->Length);
              v41 = *(_DWORD *)(UoW->LastWriteTime.QuadPart + 24);
              *((_DWORD *)v4 + 12) = v41;
              v40 = v41;
              v38 = (char *)v4 + v11->Length + 64;
              v4[7] = v38;
              p_Cell = UoW->ChildKCB;
            }
            memmove(v38, p_Cell + 8, v40);
            goto LABEL_34;
          }
          v33 = -1073741562;
LABEL_39:
          if( v49 )
            (*(void(__fastcall **)(_QWORD, int *))(*(_QWORD *)(UoW->LastWriteTime.QuadPart + 32) + 16i64))(
              *(_QWORD *)(UoW->LastWriteTime.QuadPart + 32),
              v50);
          v17 = v56;
          goto LABEL_42;
        }
        v20 = 64;
        v42 = (*(__int64(__fastcall **)(_QWORD, _QWORD, int *))(*(_QWORD *)(UoW->LastWriteTime.QuadPart + 32) + 8i64))(
                *(_QWORD *)(UoW->LastWriteTime.QuadPart + 32),
                *(unsigned int *)(UoW->LastWriteTime.QuadPart + 40),
                v50);
        v49 = v42;
        if( v42 )
        {
          v43 = *(_WORD *)(v42 + 72);
          if( (*(_BYTE *)(v42 + 2) & 0x20) != 0 )
            v43 *= 2;
          v8 = v43;
          v2 = v43 + 64;
          goto LABEL_18;
        }
        goto LABEL_69;
      }
      DescriptorLength = *(_DWORD *)(UoW->LastWriteTime.QuadPart + 24);
    }
    v20 = 64;
    v2 = DescriptorLength + 64;
LABEL_18:
    if( v2 < v20 )
    {
      v33 = -1073741675;
      goto LABEL_39;
    }
    v5 = pcbInfoBuffer;
    goto LABEL_20;
  }
  return -1073741670;
}

Referenced by: