CmpAddToHiveFileList

NTSTATUS __stdcall CmpAddToHiveFileList(_CMHIVE *CmHive){
  VOID *TransientPoolWithTag; 
  int v3; 
  unsigned int v4; 
  __int16 *v5; 
  int v6; 
  UINT64 DataSize; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 v11; 
  UINT64 ReturnLength; 
  VOID *KeyHandle; 

  DestinationString = 0i64;
  LODWORD(ReturnLength) = 0;
  v11 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyHandle = 0i64;
  if( !*(&WheapErrorSourceTable + 102) )
  {
    RtlInitUnicodeString(&DestinationString, L"\\registry\\machine\\system\\currentcontrolset\\control\\hivelist");
    LODWORD(DataSize) = 1;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v3 = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, DataSize, 0i64);
    if( v3 < 0 )
      return v3;
    if( _InterlockedCompareExchange64((_QWORD *)&WheapErrorSourceTable + 102, (signed __int64)KeyHandle, 0i64) )
      ZwClose((_HANDLE)KeyHandle);
  }
  TransientPoolWithTag = CmpAllocateTransientPoolWithTag(1ui64, 0x202ui64);
  if( !TransientPoolWithTag )
    return -1073741801;
  if( (CmHive->Hive.HiveFlags & 1) != 0 )
  {
    v5 = &v11;
    v6 = 2;
    goto LABEL_6;
  }
  v3 = ZwQueryObject(CmHive->FileHandles[0], ObjectNameInformation, TransientPoolWithTag, 0x200ui64, &ReturnLength);
  v4 = ReturnLength - 16;
  LODWORD(ReturnLength) = ReturnLength - 16;
  if( v3 >= 0 )
  {
    v5 = (__int16 *)*((_QWORD *)TransientPoolWithTag + 1);
    v5[(unsigned __int64)v4 >> 1] = 0;
    v6 = ReturnLength + 2;
LABEL_6:
    LODWORD(DataSize) = v6;
    LODWORD(ReturnLength) = v6;
    v3 = ZwSetValueKey(*(&WheapErrorSourceTable + 102), &CmHive->HiveRootPath, 0i64, 1ui64, v5, DataSize);
  }
  CmSiFreeMemory((PPRIVILEGE_SET)TransientPoolWithTag);
  return v3;
}

Referenced by: