CmKeyBodyReplicateToVirtual

NTSTATUS __stdcall CmKeyBodyReplicateToVirtual(CM_KEY_BODY **KeyBody, UINT64 DesiredAccess, UINT64 *VirtContext){
  UINT8 *v3; 
  unsigned int v4; 
  UINT8 *v6; 
  CM_KEY_BODY *v7; 
  _CM_KEY_CONTROL_BLOCK *KeyControlBlock; 
  _UNICODE_STRING *v9; 
  NTSTATUS v10; 
  __int64 v12; 
  unsigned int v13; 
  _GENERIC_MAPPING *GenericMapping; 
  char v15; 
  char v16; 
  _UNICODE_STRING DestinationString; 
  __int64 v18; 
  __int64 v19; 
  CM_KEY_BODY **v20; 
  _QWORD a1[2]; 
  _OBJECT_ATTRIBUTES v22; 
  INT64 v23[38]; 
  _KAPC_STATE ApcState; 
  int v25[40]; 
  _AUX_ACCESS_DATA AuxData; 

  v18 = 0i64;
  v4 = (unsigned int)VirtContext;
  v16 = DesiredAccess;
  v20 = KeyBody;
  v15 = 0;
  DestinationString = 0i64;
  v6 = v3;
  memset(&ApcState, 0, sizeof(ApcState));
  *(_OWORD *)a1 = 0i64;
  memset(v25, 0i64, sizeof(v25));
  memset(&AuxData, 0i64, sizeof(AuxData));
  memset(&v22, 0, sizeof(v22));
  RtlInitUnicodeString(&DestinationString, 0i64);
  v7 = *KeyBody;
  memset(v23, 0i64, 0x128u);
  LODWORD(v23[12]) = -1;
  v23[19] = (INT64)&v23[18];
  v23[18] = (INT64)&v23[18];
  memset(&v23[27], 0i64, 0x50u);
  v19 = 0i64;
  CmpInitializeDelayDerefContext(a1);
  CmpAttachToRegistryProcess(&ApcState);
  CmpLockRegistry();
  KeyControlBlock = v7->KeyControlBlock;
  CmpLockKcbExclusive((INT64)KeyControlBlock);
  if( !KCBNeedsVirtualImage((INT64)v7->KeyControlBlock) )
  {
LABEL_5:
    v10 = -1073741790;
    goto LABEL_6;
  }
  v10 = CmpPerformKeyBodyDeletionCheck(v7, 0i64);
  if( v10 < 0 )
  {
LABEL_6:
    CmpUnlockKcb(KeyControlBlock);
    CmpUnlockRegistry();
    goto LABEL_7;
  }
  if( !(unsigned __int8)CmpReparseToVirtualPath(KeyControlBlock, v9, (_UNICODE_STRING *)v6) )
  {
    if( (KeyControlBlock->_bf_b8 & 0x20) == 0 )
    {
      v10 = CmpCheckAdminAccess(v4, &KeyControlBlock->CachedSecurity->Descriptor, v6);
      if( v10 < 0 )
        goto LABEL_6;
    }
    goto LABEL_5;
  }
  CmpUnlockKcb(KeyControlBlock);
  CmpDrainDelayDerefContext((UINT64 **)a1);
  CmpUnlockRegistry();
  LODWORD(v23[0]) = 8;
  v23[9] = (INT64)v7->Trans.TransPtr;
  v10 = SeCreateAccessStateFromSubjectContext(
          (_SECURITY_SUBJECT_CONTEXT *)v6,
          (_ACCESS_STATE *)v25,
          &AuxData,
          v4,
          (_GENERIC_MAPPING *)((char *)CmKeyObjectType + 76));
  if( v10 >= 0 )
  {
    v22.RootDirectory = 0i64;
    v13 = 1600;
    v22.Length = 48;
    if( v16 != 1 )
      v13 = 576;
    v22.Attributes = v13;
    v22.ObjectName = &DestinationString;
    LOBYTE(GenericMapping) = 0;
    *(_OWORD *)&v22.SecurityDescriptor = 0i64;
    v10 = CmObReferenceObjectByName(
            &v22,
            (_ACCESS_STATE *)v25,
            v4,
            v12,
            (INT64)GenericMapping,
            (__int64)v23,
            (__int64)&v19);
    if( v10 >= 0 )
    {
      *v20 = (CM_KEY_BODY *)v19;
      HalPutDmaAdapter((PADAPTER_OBJECT)v7);
      v10 = 0;
    }
    SeDeleteAccessState((_ACCESS_STATE *)v25);
  }
LABEL_7:
  CmpCleanupParseContext((INT64)v23, 0);
  if( DestinationString.Buffer )
    RtlFreeAnsiString(&DestinationString);
  CmpDetachFromRegistryProcess(&ApcState);
  return v10;
}

Referenced by: