CmQueryLayeredKey

__int64 __fastcall CmQueryLayeredKey(__int64 a1, int a2, unsigned int *a3, unsigned int a4, unsigned int *a5){
  _CM_KEY_CONTROL_BLOCK *v9; 
  signed int started; 
  unsigned int v11; 
  const VOID **v12; 
  size_t v13; 
  INT64 v15; 
  bool v16; 
  int v17; 
  bool v18; 
  unsigned __int32 bf_b8; 
  int v20; 
  unsigned int v21; 
  int v22; 
  unsigned int v23; 
  unsigned int v24; 
  INT16 LayerHeight; 
  INT64 KcbAtLayerHeight; 
  __int16 v27; 
  __int64 v28; 
  int v29; 
  int v30; 
  char v31; 
  PVOID P; 
  INT64 v33[2]; 
  __int128 v34; 
  __int128 v35; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  INT64 v37[10]; 

  *(_OWORD *)v33 = 0i64;
  v34 = 0i64;
  memset(v37, 0i64, sizeof(v37));
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  CmpInitializeKcbStack((INT64)v33);
  v31 = 0;
  CmpInitializeKeyNodeStack((INT64)v37);
  P = 0i64;
  v35 = 0i64;
  v9 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
  started = CmpStartKcbStackForTopLayerKcb((INT64)v33, (INT64)v9);
  if( started < 0 )
    goto LABEL_11;
  CmpLockKcbStackShared((INT64)v33);
  v31 = 1;
  if( a2 == 3 )
  {
    if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) && (*(_DWORD *)(a1 + 48) & 1) != 0 )
    {
      started = -1073740763;
    }
    else
    {
      started = CmpConstructNameWithStatus(v9, (_UNICODE_STRING **)&P);
      if( started >= 0 )
      {
        v11 = *(unsigned __int16 *)P + 4;
        *a5 = v11;
        if( a4 >= 4 )
        {
          v12 = (const VOID **)P;
          *a3 = *(unsigned __int16 *)P;
          v13 = a4 - 4;
          if( a4 - 4 >= *(unsigned __int16 *)v12 )
            v13 = *(unsigned __int16 *)v12;
          memmove(a3 + 1, v12[1], v13);
          if( v11 > a4 )
            started = -2147483643;
          else
            started = CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) != 0 ? 0xC000017C : 0;
        }
        else
        {
          started = -1073741789;
        }
      }
    }
    goto LABEL_11;
  }
  started = CmpPerformKeyBodyDeletionCheck((CM_KEY_BODY *)a1, 0i64);
  if( started < 0 )
    goto LABEL_11;
  if( a2 == 6 )
  {
    SeCaptureSubjectContextEx((PETHREAD)KeGetCurrentThread(), KeGetCurrentThread()->Process, &SubjectContext);
    v16 = KCBNeedsVirtualImage_0((__int64)v9);
    v17 = v16 | v35 & 0xFFFFFFFE;
    v18 = KCBNeedsVirtualImage_0((__int64)v9);
    bf_b8 = v9->_bf_b8;
    if( !v18 || (v20 = 2, (bf_b8 & 0x20) != 0) )
      v20 = 0;
    v21 = v20 | v17 & 0xFFFFFFFD;
    if( !CmpVEEnabled || (v22 = 4, (bf_b8 & 0x1000000) == 0) )
      v22 = 0;
    v23 = v22 & 0xFFFFFFE7 | v21 & 0xFFFFFFE3 | ((HIWORD(bf_b8) & 0x80 | (bf_b8 >> 19) & 0x40) >> 3);
    SeReleaseSubjectContext(&SubjectContext);
    *a5 = 4;
    if( a4 < 4 )
    {
      started = -1073741789;
      goto LABEL_11;
    }
    *a3 = v23;
    goto LABEL_30;
  }
  if( a2 == 8 )
  {
    if( (v9->KeyHash.KeyHive[2].Storage[1].FreeDisplay[6].RealVectorSize & 1) != 0 )
      v24 = v35 & 0xFFFFFFFE;
    else
      v24 = v35 | 1;
    *a5 = 4;
    if( a4 < 4 )
    {
      started = -1073741789;
      goto LABEL_11;
    }
    *a3 = v24;
    goto LABEL_30;
  }
  LayerHeight = v9->LayerHeight;
  if( LayerHeight < 0 )
  {
LABEL_43:
    v28 = 0i64;
  }
  else
  {
    while( 1 )
    {
      KcbAtLayerHeight = CmpGetKcbAtLayerHeight((INT64)v33, LayerHeight);
      if( *(_DWORD *)(KcbAtLayerHeight + 40) != -1 )
        break;
      LayerHeight = v27 - 1;
      if( LayerHeight < 0 )
        goto LABEL_43;
    }
    v28 = KcbAtLayerHeight;
  }
  if( a2 == 5 )
  {
    LODWORD(v35) = CmGetKeyFlags(v28, 0i64, v15);
    DWORD1(v35) = *(int *)(v28 + 40) < 0;
    if( CmpIsKeyStackSymlink((INT64)v33) )
      DWORD1(v35) = v29 | 2;
    v30 = (*(_DWORD *)(v28 + 184) >> 4) & 0xF;
    *a5 = 12;
    if( a4 < 0xC )
    {
      started = -1073741789;
      goto LABEL_11;
    }
    *(_QWORD *)a3 = v35;
    a3[2] = v30;
LABEL_30:
    started = 0;
    goto LABEL_11;
  }
  started = CmpStartKeyNodeStackFromKcbStack((INT64)v37, (INT64)v33);
  if( started >= 0 )
  {
    started = CmpQueryKeyDataFromKeyNodeStack((__int16 *)v37, a2, (__int64)a3, a4, a5);
    if( started >= 0 )
      started = 0;
  }
LABEL_11:
  CmpCleanupKeyNodeStack((INT64)v37);
  if( P )
    ExFreePoolWithTag(P, 0x624E4D43u);
  if( v31 )
    CmpUnlockKcbStack((INT64)v33);
  CmpCleanupKcbStack((INT64)v33);
  return(unsigned int)started;
}

Referenced by: