CmpReportNotifyHelper

void __fastcall CmpReportNotifyHelper(
        _CM_KEY_CONTROL_BLOCK *KeyControlBlock,
        _HHIVE *SearchHive,
        _HHIVE *Hive,
        UINT64 Cell,
        _CM_TRANS *CmTrans,
        UINT64 Filter,
        _LIST_ENTRY *DeferredPostAsync){
  INT16 v8; 
  int v10; 
  _EX_PUSH_LOCK *p_Cluster; 
  INT64 KcbAtLayerHeight; 
  unsigned __int8 CurrentIrql; 
  int(__fastcall *i)(_HHIVE *, unsigned int, unsigned int, void *, unsigned int); 
  __int64 v16; 
  void *v17; 
  __int64 v18; 
  INT64 v19; 
  unsigned int v20; 
  INT64 v21; 
  UINT8 v22; 
  LIST_ENTRY *ExternalDeferredPostAsync; 
  _LIST_ENTRY DelayedDeref; 

  v8 = WORD1(KeyControlBlock->RefCount);
  v10 = Cell;
  DelayedDeref.Blink = &DelayedDeref;
  DelayedDeref.Flink = &DelayedDeref;
  p_Cluster = (_EX_PUSH_LOCK *)&SearchHive[1].Cluster;
  KcbAtLayerHeight = CmpGetKcbAtLayerHeight((INT64)KeyControlBlock, v8);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&SearchHive[1].Cluster, 0i64);
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(1ui64);
  for( i = SearchHive[1].FileRead;
        i;
        i = *(int(__fastcall **)(_HHIVE *, unsigned int, unsigned int, void *, unsigned int))i )
  {
    v16 = *((_QWORD *)i + 4);
    if( (*(_DWORD *)(v16 + 8) & 0x7FE00000u) > (*(_DWORD *)(KcbAtLayerHeight + 8) & 0x7FE00000u) )
      break;
    if( (v10 & *((_DWORD *)i + 12) & 0x3FFFFFFF) != 0
      && ((*((_DWORD *)i + 12) & 0x40000000) != 0 || v16 == KcbAtLayerHeight) )
    {
      v17 = *(void **)(*((_QWORD *)i + 5) + 56i64);
      if( (!Hive || Hive->HiveLoadFailure == v17) && (!v17 || (unsigned int)CmpTransIsTransActive((_CM_TRANS_PTR)v17)) )
      {
        v18 = *((_QWORD *)i + 4);
        v19 = KcbAtLayerHeight;
        v20 = (*(_DWORD *)(v18 + 8) >> 21) & 0x3FF;
        if( ((*(_DWORD *)(KcbAtLayerHeight + 8) >> 21) & 0x3FFu) > v20 )
        {
          do
            v19 = *(_QWORD *)(v19 + 72);
          while( ((*(_DWORD *)(v19 + 8) >> 21) & 0x3FFu) > v20 );
        }
        if( v19 == v18 && CmpNotifyTriggerCheck((__int64)i, (__int64)KeyControlBlock, (__int64)Hive) )
        {
          LOBYTE(ExternalDeferredPostAsync) = 0;
          CmpPostNotify((CM_NOTIFY_BLOCK *)i, v21, v22, (LIST_ENTRY *)0x10C, ExternalDeferredPostAsync);
        }
      }
    }
  }
  __writecr8(CurrentIrql);
  if( (_InterlockedExchangeAdd64(&p_Cluster->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(p_Cluster);
  KeAbPostRelease(p_Cluster);
  CmpDelayedDerefKeys(&DelayedDeref);
}

Referenced by: