CmpCreateEmptyHiveClone

INT64 __fastcall CmpCreateEmptyHiveClone(INT64 *a1, INT64 a2){
  CMHIVE *v4; 
  CMHIVE *v5; 
  NTSTATUS v6; 
  UINT64 *v7; 
  unsigned int v8; 
  __int64 v9; 
  _LARGE_INTEGER *LogFileSizes; 
  __int64 v11; 
  int v12; 
  INT64 v14; 
  INT64 v15; 
  INT64 v16; 

  v4 = (CMHIVE *)CmpAllocate(0x12E8ui64, 0, 0x30314D43ui64);
  v5 = v4;
  if( v4 )
  {
    CmpHiveInitialize(v4);
    v7 = (UINT64 *)(a2 + 1536);
    v8 = 0;
    v5->Flags = *(_DWORD *)(a2 + 4152);
    v9 = 2i64;
    while( 1 )
    {
      if( *v7 )
      {
        LODWORD(v16) = 2;
        LODWORD(v15) = 512;
        LODWORD(v14) = 0;
        v6 = ObDuplicateObject(
               (INT64)PsInitialSystemProcess,
               *v7,
               0i64,
               (UINT64 *)&v5->FileHandles[v8],
               v14,
               v15,
               v16,
               0);
        if( v6 < 0 )
          break;
      }
      ++v8;
      ++v7;
      if( v8 >= 6 )
      {
        LogFileSizes = v5->LogFileSizes;
        v5->LastShrinkHiveSize = *(_DWORD *)(a2 + 1784);
        v5->ActualFileSize.QuadPart = *(_QWORD *)(a2 + 1792);
        do
        {
          *LogFileSizes = *(_LARGE_INTEGER *)((char *)LogFileSizes + a2 - (_QWORD)v5);
          ++LogFileSizes;
          --v9;
        }
        while( v9 );
        v5->DirtyTime = *(_QWORD *)(a2 + 4176);
        v5->UnreconciledTime = *(_QWORD *)(a2 + 4184);
        v5->LastWriteTime.QuadPart = *(_QWORD *)(a2 + 4224);
        v11 = *(_QWORD *)(a2 + 4832);
        if( v11 )
        {
          if( _InterlockedIncrement64((volatile signed __int64 *)(v11 + 24)) <= 1 )
            __fastfail(0xEu);
          v5->VolumeContext = *(_CMP_VOLUME_CONTEXT **)(a2 + 4832);
        }
        HvHiveStartEmptyClone((INT64)v5, a2);
        v6 = v12;
        if( v12 >= 0 )
        {
          *a1 = (INT64)v5;
          v5 = 0i64;
          v6 = 0;
        }
        break;
      }
    }
    if( v5 )
      CmpDestroyHive(v5);
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)v6;
}

Referenced by: