CmpCmdHiveOpen

__int64 __fastcall CmpCmdHiveOpen(
        const UNICODE_STRING *a1,
        char a2,
        char *a3,
        ULONG_PTR *a4,
        unsigned int a5,
        char a6,
        __int64 a7,
        _BYTE *a8,
        void *a9){
  UINT8 v13; 
  int v14; 
  int v15; 
  int v16; 
  unsigned int v17; 
  NTSTATUS inited; 
  NTSTATUS v19; 
  unsigned int v20; 
  int v21; 
  struct _DMA_ADAPTER *v22; 
  NTSTATUS v23; 
  _ETHREAD *CurrentThread; 
  UINT64 ImpersonationLevel; 
  UINT64 ImpersonationLevela; 
  _GUID *v28; 
  _GUID *v29; 
  UINT8 *v30; 
  UINT8 *v31; 
  BOOL v32; 
  INT64 HiveRmUuid[2]; 
  _HIVE_LOAD_FAILURE *HiveLoadFailure; 
  _CMHIVE **CmHive; 
  __int64 v36; 
  struct _EVENT_DATA_DESCRIPTOR v37; 
  __int64 *v38; 
  __int64 v39; 
  HiveRmUuid[0] = a7;
  HiveLoadFailure = (_HIVE_LOAD_FAILURE *)a8;
  HiveRmUuid[1] = (INT64)a9;
  CmHive = (_CMHIVE **)a4;
  v13 = IoSetThreadHardErrorMode(0);
  v14 = 0;
  BYTE2(v32) = v13;
  if( (a6 & 1) != 0 )
  {
    v14 = 0x8000;
    if( (a6 & 2) == 0 )
      v14 = 294912;
  }
  v15 = v14 | 0x80000;
  if( (a6 & 4) == 0 )
    v15 = v14;
  v16 = v15 | 0x108000;
  if( (a6 & 8) == 0 )
    v16 = v15;
  v17 = v16 | 2;
  if( (a5 & 0x20000000) == 0 )
    v17 = v16;
  LODWORD(ImpersonationLevel) = a5;
  inited = CmpInitHiveFromFile(
             (_UNICODE_STRING *)a1,
             v17,
             (_CMHIVE **)a4,
             (UINT8 *)a3,
             ImpersonationLevel,
             (_GUID *)HiveRmUuid[0],
             v28,
             v30,
             HiveLoadFailure);
  v19 = inited;
  if( !HiveRmUuid[0] && a2 && (a6 & 0x20) == 0 )
  {
    if( inited == -1073741790
      || (v20 = inited + 1073741724, v20 <= 0xE) && (v21 = 17473, _bittest(&v21, v20))
      || v19 == -1073741421 )
    {
      LOWORD(v32) = 0;
      LODWORD(HiveRmUuid[0]) = 0;
      v22 = (struct _DMA_ADAPTER *)PsReferenceImpersonationTokenEx(
                                     (INT64)KeGetCurrentThread(),
                                     1,
                                     (BYTE *)&v32 + 1,
                                     &v32,
                                     HiveRmUuid,
                                     0i64);
      v19 = RtlImpersonateSelfEx(SecurityImpersonation, 0i64, 0i64);
      if( v19 >= 0 )
      {
        LODWORD(ImpersonationLevela) = a5;
        v23 = CmpInitHiveFromFile(
                (_UNICODE_STRING *)a1,
                v17,
                CmHive,
                (UINT8 *)a3,
                ImpersonationLevela,
                0i64,
                v29,
                v31,
                HiveLoadFailure);
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        v19 = v23;
        if( v22 )
          PsImpersonateClient(CurrentThread, v22, BYTE1(v32), v32, HiveRmUuid[0]);
        else
          PsImpersonateClient(CurrentThread, 0i64, 0, 0, SecurityImpersonation);
        if( v19 >= 0
          && (a5 & 0x2000000) != 0
          && (unsigned int)dword_140C02130 > 5
          && tlgKeywordOn((__int64)&dword_140C02130, 0x400000000008i64) )
        {
          v36 = 0x1000000i64;
          v38 = &v36;
          v39 = 8i64;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&dword_140C02130,
            (unsigned __int8 *)byte_140022D4B,
            0i64,
            0i64,
            3u,
            &v37);
        }
      }
      if( v22 )
        HalPutDmaAdapter(v22);
    }
  }
  IoSetThreadHardErrorMode(BYTE2(v32));
  return(unsigned int)v19;
}

Referenced by: