CmpDoWritethroughReparse

INT64 __fastcall CmpDoWritethroughReparse(
        INT64 a1,
        INT64 a2,
        INT64 a3,
        CHAR a4,
        _UNICODE_STRING *a5,
        INT64 a6,
        _UNICODE_STRING *a7){
  bool v11; 
  unsigned int v12; 
  INT64 KcbAtLayerHeight; 
  int started; 
  INT64 v15; 
  INT64 v16; 
  INT64 v17; 
  _CM_KEY_CONTROL_BLOCK *v18; 
  unsigned int v19; 
  UINT64 v20; 
  INT64 v21; 
  int v22; 
  int v23; 
  _UNICODE_STRING *v24; 
  _UNICODE_STRING DestinationString; 
  INT64 v27[2]; 
  PPRIVILEGE_SET Privileges[2]; 
  _UNICODE_STRING *SourceString; 

  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  v11 = *(_DWORD *)(a1 + 40) == -1;
  *(_OWORD *)v27 = 0i64;
  WORD1(v27[0]) = -1;
  SourceString = 0i64;
  *(_OWORD *)Privileges = 0i64;
  if( !v11 )
  {
    v12 = -1073741199;
    goto LABEL_28;
  }
  if( (*(_DWORD *)(*(_QWORD *)(a1 + 32) + 4152i64) & 0x2000) == 0 )
  {
    v12 = -1073741199;
    goto LABEL_28;
  }
  if( !a4 )
    goto LABEL_12;
  if( *(_BYTE *)(*(_QWORD *)(a1 + 72) + 65i64) )
  {
    v12 = -1073741199;
    goto LABEL_28;
  }
  KcbAtLayerHeight = CmpGetKcbAtLayerHeight(a3, *(_WORD *)(a1 + 66) - 1);
  started = CmpStartKcbStackForTopLayerKcb((INT64)v27, KcbAtLayerHeight);
  v12 = started;
  if( started >= 0 )
  {
    if( CmpIsKeyStackDeleted((INT64)v27, 0i64) )
    {
      v12 = -1073741199;
      goto LABEL_28;
    }
LABEL_12:
    v18 = (_CM_KEY_CONTROL_BLOCK *)CmpGetKcbAtLayerHeight(a2, *(_WORD *)(a1 + 66) - 1);
    v19 = CmpKeyFullNameLength(v18);
    v20 = v19;
    if( v19 <= 0xFFFF )
    {
      v21 = a6;
      if( (*(_DWORD *)(a6 + 160) & 1) == 0 )
      {
        CmpAttachToRegistryProcess((KAPC_STATE *)(a6 + 168));
        *(_DWORD *)(v21 + 160) |= 1u;
      }
      if( a4 )
      {
        v22 = CmpConstructNameWithStatus(v18->ParentKcb, &SourceString);
        v12 = v22;
        if( v22 < 0 )
        {
          v16 = (unsigned int)v22;
          v17 = 66048i64;
          v15 = v21;
          goto LABEL_27;
        }
      }
      else
      {
        v23 = CmpConstructNameWithStatus(v18, &SourceString);
        v12 = v23;
        if( v23 < 0 )
        {
          v16 = (unsigned int)v23;
          v17 = 66304i64;
          v15 = v21;
          goto LABEL_27;
        }
      }
      DestinationString.Buffer = (wchar_t *)ExAllocatePoolWithTag(1ui64, v20, 909528387i64);
      if( !DestinationString.Buffer )
      {
        v12 = -1073741670;
        CmpRecordParseFailure(v21, 66560i64, 3221225626i64);
        goto LABEL_30;
      }
      DestinationString.Length = 0;
      DestinationString.MaximumLength = v20;
      RtlUnicodeStringCopy(&DestinationString, SourceString);
      if( a4 )
      {
        CmpUnicodeStringAppendCharacter(&DestinationString.Length);
        RtlUnicodeStringCat(&DestinationString, a5);
      }
      v24 = a7;
      ExFreePoolWithTag(a7->Buffer, 0);
      *v24 = DestinationString;
      RtlInitUnicodeString(&DestinationString, 0i64);
      *(_DWORD *)(v21 + 24) |= 0x10u;
      v17 = 66816i64;
      v15 = v21;
      v12 = 872;
    }
    else
    {
      v15 = a6;
      v12 = -1073741811;
      v17 = 65872i64;
    }
    v16 = v12;
    goto LABEL_27;
  }
  v15 = a6;
  v16 = (unsigned int)started;
  v17 = 65792i64;
LABEL_27:
  CmpRecordParseFailure(v15, v17, v16);
LABEL_28:
  if( DestinationString.Buffer )
    ExFreePoolWithTag(DestinationString.Buffer, 0);
LABEL_30:
  if( SourceString )
    CmSiFreeMemory((PPRIVILEGE_SET)SourceString);
  if( Privileges[1] )
    CmSiFreeMemory(Privileges[1]);
  return v12;
}

Referenced by: