CmpDeleteKeyObject

VOID __stdcall CmpDeleteKeyObject(VOID *Object){
  char v2; 
  INT64 v3; 
  INT64 v4; 
  _ETHREAD *CurrentThread; 
  UINT8 v6; 
  _CM_KEY_CONTROL_BLOCK *v7; 
  _HHIVE *KeyHive; 
  _PRIVILEGE_SET *v9; 
  _HHIVE *v10; 
  _LIST_ENTRY DeferredPostAsync; 
  LIST_ENTRY ThList; 
  _QWORD a1[2]; 
  __int128 Argument[2]; 

  ThList.Blink = &ThList;
  v2 = 0;
  ThList.Flink = &ThList;
  memset(Argument, 0, sizeof(Argument));
  *(_OWORD *)a1 = 0i64;
  CmpInitializeDelayDerefContext(a1);
  if( (*((_DWORD *)Object + 12) & 4) == 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    if( dword_140C5083C )
    {
      if( !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, v3, v4) )
      {
        *(_QWORD *)&Argument[0] = Object;
        CmpCallCallBacks(RegNtKeyHandleClose, Argument, v6, RegNtPostKeyHandleClose, Object, &ThList);
        if( *(_DWORD *)Object == 1803104306 && *((VOID **)Object + 9) != (char *)Object + 72 )
        {
          CmpFireCleanupNotifications((CM_KEY_BODY *)Object);
          CmpFreeCallbackObjectContexts((CM_KEY_BODY *)Object);
        }
      }
    }
    if( *((_QWORD *)Object + 7) )
      CmpTransDereferenceTransaction(*((_QWORD *)Object + 7));
    DeferredPostAsync.Blink = &DeferredPostAsync;
    DeferredPostAsync.Flink = &DeferredPostAsync;
    CmpLockRegistry();
    v7 = (_CM_KEY_CONTROL_BLOCK *)*((_QWORD *)Object + 1);
    if( v7 )
    {
      if( *(_DWORD *)Object == 1803104306 )
      {
        if( *((_QWORD *)Object + 2) )
        {
          CmpLockKcbExclusive(*((_QWORD *)Object + 1));
          CmpFlushNotify((__int64)Object, 0i64, (__int128 *)&DeferredPostAsync);
          CmpUnlockKcb(v7);
        }
        DelistKeyBodyFromKCB((_EPROCESS *)Object, 0);
        KeyHive = v7->KeyHash.KeyHive;
        if( LOBYTE(KeyHive[1].Storage[1].FreeDisplay[19].Display.SizeOfBitMap) == 1 )
        {
          v2 = 1;
          *(&KeyHive[2].Storage[1].FreeDisplay[11].Display.SizeOfBitMap
          + (_InterlockedExchangeAdd((volatile signed __int32 *)&KeyHive[2].Storage[1].FreeDisplay[11].Hint, 1u) & 0x7F)) = 16;
        }
        v9 = (_PRIVILEGE_SET *)*((_QWORD *)Object + 11);
        if( v9 )
        {
          CmpKeyEnumStackFreeResumeContext(v9);
          CmpDrainDelayDerefContext((UINT64 **)a1);
        }
      }
      else
      {
        v10 = v7->KeyHash.KeyHive;
        if( LOBYTE(v10[1].Storage[1].FreeDisplay[19].Display.SizeOfBitMap) == 1 )
        {
          v2 = 1;
          *(&v10[2].Storage[1].FreeDisplay[11].Display.SizeOfBitMap
          + (_InterlockedExchangeAdd((volatile signed __int32 *)&v10[2].Storage[1].FreeDisplay[11].Hint, 1u) & 0x7F)) = 17;
        }
      }
      CmpDereferenceKeyControlBlock((UINT64)v7);
    }
    CmpUnlockRegistry();
    CmpSignalDeferredPosts(&DeferredPostAsync);
    CmPostCallbackNotification(RegNtPostKeyHandleClose, 0i64, 0i64, Argument, &ThList);
    if( v2 )
    {
      if( *((char *)Object - 21) < 0 )
        CmpWaitForLateUnloadWorker();
    }
    KeLeaveCriticalRegion();
  }
}

Referenced by: