CmpCreateRegistryRoot

INT64 __fastcall CmpCreateRegistryRoot(){
  UINT64 *v0; 
  INT64 result; 
  UINT8 v2; 
  CHAR *v3; 
  NTSTATUS v4; 
  _CM_COMPONENT_HASH v5; 
  _CM_KEY_BODY *v6; 
  _CM_KEY_CONTROL_BLOCK *v7; 
  _CM_KEY_BODY *v8; 
  _CM_KEY_CONTROL_BLOCK *v9; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  PVOID v13; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID BugCheckParameter2; 
  _CM_KEY_BODY *KeyBody; 
  PVOID Handle; 

  KeyBody = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  BugCheckParameter2 = 0i64;
  Handle = 0i64;
  DestinationString = 0i64;
  if( CmpCreateRootNode(v0) )
  {
    v3 = CmpHiveRootSecurityDescriptor(v2);
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &CmRegistryRootName;
    ObjectAttributes.Attributes = 576;
    LODWORD(NonPagedPoolCharge) = 0;
    LODWORD(PagedPoolCharge) = 0;
    LODWORD(ObjectBodySize) = 104;
    ObjectAttributes.SecurityDescriptor = v3;
    ObjectAttributes.SecurityQualityOfService = 0i64;
    v4 = ObCreateObject(
           0,
           (_OBJECT_TYPE *)CmKeyObjectType,
           &ObjectAttributes,
           0,
           0i64,
           ObjectBodySize,
           PagedPoolCharge,
           NonPagedPoolCharge,
           (VOID **)&KeyBody);
    result = (INT64)ExFreePoolWithTag(v3, 0);
    if( v4 >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, L"REGISTRY");
      v5.Hash = CmpHashUnicodeComponent(&DestinationString);
      result = CmpCreateKeyControlBlock(
                 *(_CMHIVE **)&CmpMasterHive,
                 0,
                 0i64,
                 0i64,
                 0,
                 &DestinationString,
                 v5,
                 0,
                 (_CM_KEY_CONTROL_BLOCK **)&BugCheckParameter2);
      if( (int)result >= 0 )
      {
        v6 = KeyBody;
        v7 = (_CM_KEY_CONTROL_BLOCK *)BugCheckParameter2;
        KeyBody->Type = 1803104306;
        v6->KeyControlBlock = v7;
        v6->NotifyBlock = 0i64;
        v8 = KeyBody;
        KeyBody->ProcessID = (void *)KeGetCurrentThread()[1].CycleTime;
        v9 = (_CM_KEY_CONTROL_BLOCK *)BugCheckParameter2;
        *((_DWORD *)v8 + 12) = 0;
        v8->ContextListHead.Blink = &v8->ContextListHead;
        v8->ContextListHead.Flink = &v8->ContextListHead;
        v8->Trans.0 = 0i64;
        v8->KtmUow = 0i64;
        CmpTryToLockKcbExclusive(v9);
        EnlistKeyBodyWithKCB(v8, 2ui64);
        CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)BugCheckParameter2);
        LODWORD(result) = ObInsertObject(v8, 0i64, 0, 0i64, 0i64, &Handle);
        if( (int)result >= 0 )
        {
          v13 = 0i64;
          LODWORD(result) = ObReferenceObjectByHandle(Handle, 0x20019ui64, 0i64, 0, &v13, 0i64);
          CmpRegistryRootObject = v13;
          if( (int)result >= 0 )
          {
            LOBYTE(result) = 1;
            return result;
          }
          LODWORD(result) = ObCloseHandle(Handle, 0);
        }
      }
    }
  }
  LOBYTE(result) = 0;
  return result;
}

Referenced by: