CmEnumerateValueKey

__int64 __fastcall CmEnumerateValueKey(__int64 a1, unsigned int a2, int a3, _DWORD *a4, int a5, __int64 a6){
  unsigned int *ResultLength; 
  _EPROCESS *Process; 
  __int64 v10; 
  _ETHREAD *CurrentThread; 
  _CM_KEY_CONTROL_BLOCK *v13; 
  __int64 v14; 
  __int64 v15; 
  unsigned int v16; 
  _CM_KEY_VALUE *v17; 
  int KeyValueData; 
  bool v19; 
  CM_TRANS *v21; 
  __int64 v22; 
  __int64 v23; 
  unsigned int *v24; 
  CM_TRANS *CmTrans; 
  _KAPC_STATE ApcState; 

  ResultLength = (unsigned int *)a6;
  Process = (_EPROCESS *)*(&CmpDummyThreadEvent + 5);
  v10 = a2;
  v24 = (unsigned int *)a6;
  CmTrans = 0i64;
  v23 = 0xFFFFFFFFi64;
  v22 = 0xFFFFFFFFi64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( !*(&CmpDummyThreadEvent + 5) )
    Process = KeGetCurrentThread()->ApcState.Process;
  KiStackAttachProcess(Process, 0i64, &ApcState);
  if( !BYTE6(NlsMbCodePageTag) )
  {
    PsBoostThreadIo((_ETHREAD *)KeGetCurrentThread(), 0);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceSharedLite((UINT64)&CmpRegistryLock, 1);
  }
  v13 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
  if( v13->LayerHeight )
  {
    KeyValueData = CmEnumerateValueFromLayeredKey(a1, v10, a3, (__int64)a4, a5, a6);
    goto LABEL_18;
  }
  ExAcquirePushLockSharedEx(&v13->KcbPushlock, 0i64);
  _InterlockedIncrement((volatile signed __int32 *)&v13->56);
  if( CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) )
  {
    if( (*(_DWORD *)(a1 + 48) & 1) != 0 )
      KeyValueData = -1073740763;
    else
      KeyValueData = -1073741444;
  }
  else
  {
    if( !*(_QWORD *)(a1 + 56) && !*(_QWORD *)(a1 + 64) )
      goto LABEL_9;
    KeyValueData = CmpTransSearchAddTransFromKeyBody((_CM_KEY_BODY *)a1, &CmTrans);
    if( KeyValueData >= 0 )
    {
      v21 = CmTrans;
      KeyValueData = CmpPerformKeyBodyDeletionCheck((CM_KEY_BODY *)a1, CmTrans);
      if( KeyValueData >= 0 )
      {
        ResultLength = v24;
        if( v21 )
        {
          v14 = 280i64;
          if( v21 == v13->TransValueListOwner )
          {
LABEL_10:
            if( (unsigned int)v10 >= *(_DWORD *)((char *)&v13->RefCount + v14) )
            {
              KeyValueData = -2147483622;
            }
            else
            {
              v15 = (__int64)v13->KeyHash.KeyHive->GetCellRoutine(
                               v13->KeyHash.KeyHive,
                               *(_DWORD *)((char *)&v13->RefCount + v14 + 4),
                               (_HV_GET_CELL_CONTEXT *)&v23);
              v16 = *(_DWORD *)(v15 + 4 * v10);
              v17 = (_CM_KEY_VALUE *)v13->KeyHash.KeyHive->GetCellRoutine(
                                       v13->KeyHash.KeyHive,
                                       v16,
                                       (_HV_GET_CELL_CONTEXT *)&v22);
              KeyValueData = CmpQueryKeyValueData(v13, v16, v17, (_KEY_VALUE_INFORMATION_CLASS)a3, a4, a5, ResultLength);
              if( v17 )
                v13->KeyHash.KeyHive->ReleaseCellRoutine(v13->KeyHash.KeyHive, (_HV_GET_CELL_CONTEXT *)&v22);
              if( v15 )
                v13->KeyHash.KeyHive->ReleaseCellRoutine(v13->KeyHash.KeyHive, (_HV_GET_CELL_CONTEXT *)&v23);
            }
            goto LABEL_15;
          }
        }
LABEL_9:
        v14 = 96i64;
        goto LABEL_10;
      }
    }
  }
LABEL_15:
  v19 = (v13->_bf_8 & 0x80000) != 0;
  if( (struct _KTHREAD *)v13->Owner == KeGetCurrentThread() )
    v13->Owner = 0i64;
  else
    _InterlockedDecrement((volatile signed __int32 *)&v13->56);
  ExReleasePushLockEx((_DWORD)v13 + 48, 0);
  if( v19 && (v13->_bf_8 & 0x80000) != 0 )
    CmpFreeKeyControlBlock((UINT64)v13);
LABEL_18:
  if( !BYTE6(NlsMbCodePageTag) )
  {
    ExReleaseResourceLite(&CmpRegistryLock);
    KeLeaveCriticalRegion();
    PsBoostThreadIo((_ETHREAD *)KeGetCurrentThread(), 1u);
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  return(unsigned int)KeyValueData;
}

Referenced by: