CmCallbackGetKeyObjectID

NTSTATUS __stdcall CmCallbackGetKeyObjectID(
        PLARGE_INTEGER Cookie,
        PVOID Object,
        PULONG_PTR ObjectID,
        PCUNICODE_STRING *ObjectName){
  unsigned __int64 v5; 
  NTSTATUS started; 
  unsigned __int8 *v7; 
  _UNICODE_STRING *KeyPath; 
  INT64 v10[2]; 
  PPRIVILEGE_SET Privileges[2]; 
  _KAPC_STATE ApcState; 

  KeyPath = 0i64;
  *(_OWORD *)v10 = 0i64;
  WORD1(v10[0]) = -1;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_OWORD *)Privileges = 0i64;
  if( !Object || *(_DWORD *)Object != 1803104306 || !Cookie )
    goto LABEL_16;
  v5 = *((_QWORD *)Object + 1);
  if( ObjectID )
    *ObjectID = v5;
  if( !ObjectName )
  {
    started = 0;
    goto LABEL_17;
  }
  if( (v5 & 1) == 0 )
  {
    CmpAttachToRegistryProcess(&ApcState);
    CmpLockRegistry();
    started = CmpStartKcbStackForTopLayerKcb((INT64)v10, v5);
    if( started >= 0 )
    {
      CmpLockKcbStackShared((INT64)v10);
      if( *(_QWORD *)(v5 + 80) && (int)CmpConstructAndCacheName((_CM_KEY_CONTROL_BLOCK *)v5, &KeyPath, v7) >= 0 )
      {
        started = 0;
        *ObjectName = KeyPath;
      }
      else
      {
        started = -1073741670;
      }
      CmpUnlockKcbStack((INT64)v10);
    }
    CmpUnlockRegistry();
    KiUnstackDetachProcess(&ApcState, 0i64);
  }
  else
  {
LABEL_16:
    started = -1073741811;
  }
LABEL_17:
  if( Privileges[1] )
    CmSiFreeMemory(Privileges[1]);
  return started;
}

Referenced by: