CmpOKToFollowLink

UINT8 __stdcall CmpOKToFollowLink(CMHIVE *OrigHive, CMHIVE *DestHive){
  CMHIVE *Flink; 
  __int64 v5; 
  unsigned int v6; 
  __int64 v8; 
  _EVENT_DATA_DESCRIPTOR v9; 
  __int64 *v10; 
  __int64 v11; 

  if( !OrigHive || OrigHive == DestHive )
    return 1;
  if( (DestHive->Flags & 1) != 0 )
  {
    ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 340, 0i64);
    Flink = (CMHIVE *)DestHive->TrustClassEntry.Flink;
    if( Flink != (CMHIVE *)&DestHive->TrustClassEntry )
    {
      while( &Flink[-1].Hive.Storage[0].FreeDisplay[15].Display.Buffer != (unsigned int **)OrigHive )
      {
        Flink = *(CMHIVE **)&Flink->Hive.Signature;
        if( Flink == (CMHIVE *)&DestHive->TrustClassEntry )
          goto LABEL_7;
      }
      ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2720, 0);
      return 1;
    }
LABEL_7:
    ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2720, 0);
  }
  if( PsIsCurrentThreadInServerSilo() && *(&stru_140C00F40 + 1148) > 5u )
  {
    if( tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0x200000010000i64) )
    {
      v8 = 0x1000000i64;
      v10 = &v8;
      v11 = 8i64;
      tlgWriteAgg((__int64)&stru_140C00F40 + 4592, (unsigned __int8 *)&word_140021C46, v5, 3u, &v9);
      v6 = *(&stru_140C00F40 + 1148);
    }
    if( v6 > 5 )
    {
      if( tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 0i64) )
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&stru_140C00F40 + 4592,
          (unsigned __int8 *)&byte_140021C0F,
          0i64,
          0i64,
          2u,
          &v9);
    }
  }
  return 0;
}

Referenced by: