CmKeyBodyRemapToVirtual

__int64 __fastcall CmKeyBodyRemapToVirtual(
        __int64 *a1,
        char a2,
        unsigned int a3,
        _SECURITY_SUBJECT_CONTEXT *a4,
        _DWORD *a5){
  __int64 v8; 
  _CM_KEY_CONTROL_BLOCK *v9; 
  int v10; 
  __int32 bf_b8; 
  _UNICODE_STRING *v12; 
  __int64 v14; 
  unsigned int v15; 
  _GENERIC_MAPPING *GenericMapping; 
  __int64 v18; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES v20; 
  INT64 v21[38]; 
  _KAPC_STATE ApcState; 
  int v23[40]; 
  _AUX_ACCESS_DATA AuxData; 

  DestinationString = 0i64;
  memset(v23, 0i64, sizeof(v23));
  memset(&AuxData, 0i64, sizeof(AuxData));
  *(&v20.Length + 1) = 0;
  *(&v20.Attributes + 1) = 0;
  RtlInitUnicodeString(&DestinationString, 0i64);
  memset(&ApcState, 0, sizeof(ApcState));
  memset(v21, 0i64, 0x128u);
  LODWORD(v21[12]) = -1;
  v21[19] = (INT64)&v21[18];
  v21[18] = (INT64)&v21[18];
  memset(&v21[27], 0i64, 0x50u);
  v8 = *a1;
  v18 = 0i64;
  v9 = *(_CM_KEY_CONTROL_BLOCK **)(v8 + 8);
  if( v9->LayerHeight
    || (*(_DWORD *)(v8 + 48) & 0x10) != 0
    || !KCBNeedsVirtualImage(*(_QWORD *)(v8 + 8))
    || (bf_b8 = v9->_bf_b8, (bf_b8 & 0x800000) == 0)
    || (bf_b8 & 0x20) != 0 )
  {
    v10 = -1073741790;
    goto LABEL_12;
  }
  CmpAttachToRegistryProcess(&ApcState);
  CmpLockRegistry();
  CmpLockKcbShared(v9);
  v10 = CmpPerformKeyBodyDeletionCheck((CM_KEY_BODY *)v8, 0i64);
  if( v10 >= 0 )
  {
    if( (unsigned __int8)CmpReparseToVirtualPath(v9, v12, (_UNICODE_STRING *)a4) )
    {
      CmpUnlockKcb(*(_CM_KEY_CONTROL_BLOCK **)(*a1 + 8));
      CmpUnlockRegistry();
      LODWORD(v21[2]) = *a5;
      LODWORD(v21[0]) = 8;
      v21[9] = *(_QWORD *)(v8 + 56);
      v10 = SeCreateAccessStateFromSubjectContext(
              a4,
              (_ACCESS_STATE *)v23,
              &AuxData,
              a3,
              (_GENERIC_MAPPING *)((char *)CmKeyObjectType + 76));
      if( v10 >= 0 )
      {
        v20.RootDirectory = 0i64;
        v15 = 1600;
        v20.Length = 48;
        if( a2 != 1 )
          v15 = 576;
        v20.Attributes = v15;
        v20.ObjectName = &DestinationString;
        LOBYTE(GenericMapping) = 0;
        *(_OWORD *)&v20.SecurityDescriptor = 0i64;
        if( (int)CmObReferenceObjectByName(
                    &v20,
                    (_ACCESS_STATE *)v23,
                    a3,
                    v14,
                    (INT64)GenericMapping,
                    (__int64)v21,
                    (__int64)&v18) >= 0 )
        {
          *a1 = v18;
          HalPutDmaAdapter((PADAPTER_OBJECT)v8);
          v10 = 0;
        }
        else
        {
          v10 = -1073741790;
        }
        SeDeleteAccessState((_ACCESS_STATE *)v23);
      }
      goto LABEL_11;
    }
    v10 = -1073741790;
  }
  CmpUnlockKcb(v9);
  CmpUnlockRegistry();
LABEL_11:
  CmpDetachFromRegistryProcess(&ApcState);
LABEL_12:
  if( DestinationString.Buffer )
    RtlFreeAnsiString(&DestinationString);
  CmpCleanupParseContext((INT64)v21, 0);
  return(unsigned int)v10;
}

Referenced by: