CmpRmUnDoPhase

int __fastcall CmpRmUnDoPhase(__int64 a1){
  _CM_TRANS *v2; 
  __int64 v3; 
  _CM_TRANS *v4; 
  UINT64 v5; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY *Blink; 
  int v9; 
  char ReadOnlyTransaction[4]; 
  char UowCount[12]; 
  LIST_ENTRY *ListIterator; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _KAPC_STATE ApcState; 

  memset(UowCount, 0, sizeof(UowCount));
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  ReadOnlyTransaction[0] = 0;
  memset(&ApcState, 0, sizeof(ApcState));
LABEL_2:
  ListIterator = 0i64;
  while( 1 )
  {
    LODWORD(v2) = CmListGetNextElement((LIST_ENTRY *)(a1 + 16), &ListIterator, 0i64);
    v4 = v2;
    if( !v2 )
      return(int)v2;
    if( (v2->TransState & 2) != 0 )
    {
      CmpTransMgrRollback(v2, (UINT64 *)UowCount);
      CmpAttachToRegistryProcess(&ApcState);
      v5 = 8i64;
LABEL_12:
      CmpTransMgrFreeVolatileData(v4, v5);
      KiUnstackDetachProcess(&ApcState, 0i64);
      Flink = v4->TransactionListEntry.Flink;
      if( (_CM_TRANS *)v4->TransactionListEntry.Flink->Blink != v4
        || (Blink = v4->TransactionListEntry.Blink, (_CM_TRANS *)Blink->Flink != v4) )
      {
        __fastfail(3u);
      }
      Blink->Flink = Flink;
      Flink->Blink = Blink;
      ExFreePoolWithTag(v4, 0x72544D43u);
      goto LABEL_2;
    }
    ObjectAttributes.RootDirectory = (void *)((__int64)ObjectAttributes.RootDirectory & v3);
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)((__int64)ObjectAttributes.ObjectName & v3);
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenTransaction((PHANDLE)&UowCount[4], 2031679, &ObjectAttributes, (_DWORD)v2 + 88, v3 & v9) < 0 )
    {
      if( CmpTransMgrPrepare((_CM_RM *)a1, v4, (UINT64 *)UowCount, (UINT8 *)ReadOnlyTransaction) < 0
        || CmpTransMgrCommit((_CM_RM *)a1, v4, (UINT64 *)UowCount) < 0 )
      {
        v4->TransState |= 2u;
        goto LABEL_2;
      }
      CmpAttachToRegistryProcess(&ApcState);
      v5 = 4i64;
      goto LABEL_12;
    }
    ZwClose(*(_HANDLE *)&UowCount[4]);
  }
}

Referenced by: