CmpFlushBackupHive

__int64 __fastcall CmpFlushBackupHive(unsigned int a1){
  __int64 v1; 
  unsigned int v2; 
  UINT8 *v3; 
  int v4; 
  __int64 v5; 
  wchar_t *v6; 
  void *v7; 
  int inited; 
  __int64 v9; 
  VOID *v10; 
  _QWORD *v11; 
  VOID *v12; 
  UINT64 FileInformationClass; 
  UINT64 FileInformationClassa; 
  INT64 v16; 
  char FileInformation[3]; 
  __int16 ObjectInformation; 
  int v19; 
  int v20; 
  INT64 a2; 
  _STRING Destination; 
  UINT8 *a3; 
  PVOID P; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _KAPC_STATE ApcState; 
  char v28[432]; 
  char v29; 

  v1 = a1;
  P = 0i64;
  a2 = 0i64;
  a3 = 0i64;
  DestinationString = 0i64;
  v2 = 0;
  *(_QWORD *)&Destination.Length = 0x800000i64;
  v3 = 0i64;
  FileInformation[1] = 1;
  v4 = 0;
  IoStatusBlock = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(v28, 0i64, sizeof(v28));
  v5 = 25 * v1;
  Destination.Buffer = &v29;
  v6 = CmpMachineHiveList[v5 + 6];
  RtlInitUnicodeString(&DestinationString, L"\\SystemRoot\\System32\\Config\\RegBack\\");
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  RtlInitUnicodeString(&DestinationString, CmpMachineHiveList[v5]);
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  RtlAppendUnicodeToString((_UNICODE_STRING *)&Destination, (WCHAR *)L".OLD");
  v7 = (void *)*((_QWORD *)v6 + 195);
  if( v7 )
  {
    inited = CmpCmdRenameHive(v7, 0i64, (_UNICODE_STRING *)&Destination, 0i64, 1u);
    if( inited >= 0 )
    {
      Destination.Length -= 8;
      *((_QWORD *)v6 + 195) = 0i64;
      inited = CmpInitBackupHive((_CMHIVE *)v6, CmpMachineHiveList[v5]);
      if( inited < 0 )
        goto LABEL_14;
      CmpAttachToRegistryProcess(&ApcState);
      CmpLockRegistry();
      if( dword_140C50480 )
      {
        ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v6 + 9, 0i64);
        inited = HvSnapshotHiveToOffsetArray((_HHIVE *)v6, &a2, &a3, (UINT64 *)((char *)&a2 + 4));
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 9, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((_EX_PUSH_LOCK *)v6 + 9);
        KeAbPostRelease(v6 + 36);
        v2 = a2;
        v3 = a3;
        v4 = HIDWORD(a2);
      }
      else
      {
        inited = -1073741431;
      }
      CmpUnlockRegistry();
      KiUnstackDetachProcess(&ApcState, 0i64);
      if( inited < 0 )
        goto LABEL_14;
      inited = CmpWriteOffsetArrayToFile(v9, v2, (__int64)v3, v4, *((VOID **)v6 + 195));
      CmpFreeOffsetArray(v2, (PVOID *)v3);
      if( inited < 0 )
        goto LABEL_14;
      v10 = (VOID *)*((_QWORD *)v6 + 195);
      ObjectInformation = 0;
      ZwSetInformationObject(v10, ObjectHandleFlagInformation, &ObjectInformation, 2ui64);
      ZwClose(*((_QWORD *)v6 + 195));
      *((_QWORD *)v6 + 195) = 0i64;
      LODWORD(v16) = 0;
      LODWORD(FileInformationClass) = 17825793;
      FileInformation[0] = 0;
      inited = CmpCmdHiveOpen(
                 (UNICODE_STRING *)&Destination,
                 0,
                 (UINT8 *)FileInformation,
                 (CMHIVE **)&P,
                 FileInformationClass,
                 v16,
                 0i64);
      if( inited < 0 )
      {
LABEL_14:
        v12 = (VOID *)*((_QWORD *)v6 + 195);
        if( v12 )
        {
          LOWORD(v20) = 0;
          ZwSetInformationObject(v12, ObjectHandleFlagInformation, &v20, 2ui64);
          ZwClose(*((_QWORD *)v6 + 195));
          *((_QWORD *)v6 + 195) = 0i64;
        }
        if( (int)CmpCmdRenameHive(v7, 0i64, (_UNICODE_STRING *)&Destination, 0i64, 1u) >= 0 )
          *((_QWORD *)v6 + 195) = v7;
      }
      else
      {
        v11 = P;
        *((_QWORD *)v6 + 195) = *((_QWORD *)P + 192);
        v11[192] = 0i64;
        CmpAttachToRegistryProcess(&ApcState);
        CmpDestroyHive(v11);
        KiUnstackDetachProcess(&ApcState, 0i64);
        LODWORD(FileInformationClassa) = 13;
        ZwSetInformationFile((UINT64)v7, (UINT64)&IoStatusBlock, &FileInformation[1], 1ui64, FileInformationClassa);
        LOWORD(v19) = 0;
        ZwSetInformationObject(v7, ObjectHandleFlagInformation, &v19, 2ui64);
        ZwClose((_HANDLE)v7);
      }
    }
  }
  else
  {
    return(unsigned int)-1073741431;
  }
  return(unsigned int)inited;
}

Referenced by: