CmDumpKey

__int64 __fastcall CmDumpKey(__int64 a1, __int64 rdx0, char r8_0){
  __int64 v6; 
  char v7; 
  int v8; 
  INT64 v9; 
  _EX_PUSH_LOCK *v10; 
  UINT8 *v11; 
  unsigned int v12; 
  __int64 v13; 
  _EX_PUSH_LOCK *v14; 
  VOID *FileHandle; 
  VOID *FileHandlea; 
  UINT8 *a3; 
  INT64 a2; 
  UINT64 a4; 

  LODWORD(a4) = 0;
  LODWORD(a2) = 0;
  a3 = 0i64;
  CmpLockRegistry();
  v6 = *(_QWORD *)(a1 + 8);
  v7 = 1;
  if( *(_QWORD *)(v6 + 32) == *(_QWORD *)&CmpMasterHive )
  {
    v8 = -1073741790;
LABEL_23:
    CmpUnlockRegistry();
    return(unsigned int)v8;
  }
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v6 + 48), 0i64);
  _InterlockedAdd((volatile signed __int32 *)(v6 + 56), 1u);
  v8 = CmpPerformKeyBodyDeletionCheck((CM_KEY_BODY *)a1, 0i64);
  if( v8 < 0 )
  {
LABEL_22:
    CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)v6);
    goto LABEL_23;
  }
  if( (*(_DWORD *)(v6 + 184) & 0x40000) == 0 )
  {
    v8 = -1073741811;
    goto LABEL_22;
  }
  if( *(_WORD *)(v6 + 66) )
  {
    CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)v6);
    CmpUnlockRegistry();
    return(unsigned int)CmSaveKey((CM_KEY_BODY *)a1, (PVOID)rdx0, 5ui64);
  }
  else
  {
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(*(_QWORD *)(v6 + 32) + 72i64), 0i64);
    ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(*(_QWORD *)(v6 + 32) + 1776i64), 0i64);
    LOBYTE(v9) = r8_0;
    LODWORD(FileHandle) = 3;
    v8 = CmpDoAccessCheckOnSubtree(*(_QWORD *)(v6 + 32), *(unsigned int *)(v6 + 40), v9, 131097i64, (INT64)FileHandle);
    ExReleasePushLockEx(*(_QWORD *)(v6 + 32) + 1776, 0);
    if( v8 < 0 )
      goto LABEL_19;
    v8 = HvSnapshotHiveToOffsetArray(*(_HHIVE **)(v6 + 32), &a2, &a3, &a4);
    if( v8 < 0 )
    {
      v12 = a2;
      v11 = a3;
    }
    else
    {
      v10 = *(_EX_PUSH_LOCK **)(v6 + 32);
      if( (_InterlockedExchangeAdd64(&v10[9]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v10 + 9);
      KeAbPostRelease(&v10[9]);
      CmpUnlockKcb((_CM_KEY_CONTROL_BLOCK *)v6);
      CmpUnlockRegistry();
      v11 = a3;
      v7 = 0;
      FileHandlea = (VOID *)rdx0;
      v12 = a2;
      v8 = CmpWriteOffsetArrayToFile(v13, a2, (__int64)a3, a4, FileHandlea);
      if( v8 >= 0 )
        v8 = 0;
    }
    if( v11 )
      CmpFreeOffsetArray(v12, (PVOID *)v11);
    if( v7 )
    {
LABEL_19:
      v14 = *(_EX_PUSH_LOCK **)(v6 + 32);
      if( (_InterlockedExchangeAdd64(&v14[9]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v14 + 9);
      KeAbPostRelease(&v14[9]);
      goto LABEL_22;
    }
  }
  return(unsigned int)v8;
}

Referenced by: