CmpTryToRundownHive

INT64 __fastcall CmpTryToRundownHive(
        _CMHIVE *CmHive,
        _CM_KEY_CONTROL_BLOCK *RootKcb,
        UINT8 *RundownAcquired,
        UINT *RundownLogIndex){
  char v5; 
  char v6; 
  char *v9; 
  char v10; 
  PVOID **v11; 
  bool v12; 
  _CM_RM *CmRm; 
  INT64 result; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  UINT8 v18; 
  __int64 v19; 
  __int64 v20; 
  signed __int32 v21[8]; 
  UINT64 pCount[5]; 

  v5 = 0;
  v6 = 0;
  *(_OWORD *)pCount = 0i64;
  CmpInitializeRollbackPacket(pCount);
  v10 = *v9;
  while( 1 )
  {
    if( *RundownAcquired )
      CmpReleaseShutdownRundown();
    *RundownAcquired = 0;
    if( !CmpAcquireShutdownRundown() )
      goto LABEL_26;
    v12 = RootKcb->RefCount == 2;
    *RundownAcquired = 1;
    if( !v12 && (CmpDoesKeyHaveOpenSubkeys((INT64)RootKcb) || RootKcb->RefCount != 2) )
      goto LABEL_26;
    if( !v5 )
    {
      RootKcb->_bf_8 |= 0x40000u;
      CmpUnlockRegistry();
      UNLOCK_HIVE_LOAD();
      _InterlockedIncrement((_DWORD *)&WheapErrorSourceTable + 95);
      ExWaitForRundownProtectionRelease(&CmHive->HiveRundown);
      ExRundownCompleted((INT64 *)&CmHive->HiveRundown);
      v5 = 1;
      LOCK_HIVE_LOAD();
      goto LABEL_15;
    }
    CmRm = CmHive->CmRm;
    if( !CmRm || v6 )
      break;
    if( CmSnapshotRMTxArray(CmRm, pCount, v11) < 0 )
      goto LABEL_26;
    CmpLogTransactionAbortedForRollbackPacket((__int64)RootKcb, 11, (unsigned int *)pCount, v15);
    CmpUnlockRegistry();
    if( LODWORD(pCount[0]) )
    {
      UNLOCK_HIVE_LOAD();
      if( (int)CmpAbortRollbackPacket((INT64)pCount) < 0 )
      {
        LOCK_HIVE_LOAD();
        CmpLockRegistryFreezeAware(1u);
LABEL_26:
        if( v5 )
        {
          RootKcb->_bf_8 &= ~0x40000u;
          _InterlockedExchange64((volatile __int64 *)&CmHive->HiveRundown, 0i64);
          if( _InterlockedExchangeAdd((_DWORD *)&WheapErrorSourceTable + 95, 0xFFFFFFFF) == 1 )
          {
            _InterlockedOr(v21, 0);
            if( *(&CmpDummyThreadEvent + 133) )
              ExpUnblockPushLock((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 133, 0i64, 0);
          }
        }
        CmpCleanupRollbackPacket((INT64)pCount);
        if( *RundownAcquired )
        {
          CmpReleaseShutdownRundown();
          *RundownAcquired = 0;
        }
        LOBYTE(result) = 0;
        return result;
      }
      LOCK_HIVE_LOAD();
LABEL_15:
      CmpLockRegistryFreezeAware(1u);
    }
    else
    {
      LODWORD(v16) = CmCloseRmHandle(CmHive->CmRm, 0);
      v17 = v16;
      LODWORD(v19) = CmCloseTmHandle(CmHive->CmRm, v18);
      v20 = v19;
      UNLOCK_HIVE_LOAD();
      if( v17 )
        ZwClose(v17);
      if( v20 )
        ZwClose(v20);
      LOCK_HIVE_LOAD();
      CmShutdownCmRM((__int64)CmHive->CmRm, 1);
      CmpLockRegistryFreezeAware(1u);
      v6 = 1;
    }
  }
  if( _InterlockedExchangeAdd((_DWORD *)&WheapErrorSourceTable + 95, 0xFFFFFFFF) == 1 )
  {
    _InterlockedOr(v21, 0);
    if( *(&CmpDummyThreadEvent + 133) )
      ExpUnblockPushLock((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 133, 0i64, 0);
  }
  CmpCleanupRollbackPacket((INT64)pCount);
  if( !v10 )
  {
    CmpReleaseShutdownRundown();
    *RundownAcquired = 0;
  }
  LOBYTE(result) = 1;
  return result;
}

Referenced by: