CmReplaceKey

__int64 __fastcall CmReplaceKey(INT64 a1, __int64 a2, _UNICODE_STRING *a3, _LOOKASIDE_LIST_EX *a4){
  char v7; 
  char v8; 
  _PRIVILEGE_SET *TransientPoolWithTag; 
  int v10; 
  int v11; 
  _HHIVE *v12; 
  UINT64 CheckFlags; 
  UINT64 SupplementalFlags; 
  char Allocate[8]; 
  _HHIVE *Hive; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _KAPC_STATE ApcState; 
  _UNICODE_STRING ObjectInformation[32]; 

  Allocate[0] = 0;
  Hive = 0i64;
  IoStatusBlock = 0i64;
  v7 = 0;
  v8 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  TransientPoolWithTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithTag(1ui64, 0x1B0ui64);
  if( !TransientPoolWithTag )
    return(unsigned int)-1073741670;
  LODWORD(SupplementalFlags) = 0;
  LODWORD(CheckFlags) = 17825793;
  v11 = CmpCmdHiveOpen(a3, 0, (UINT8 *)Allocate, (CMHIVE **)&Hive, CheckFlags, SupplementalFlags, 0i64);
  v12 = Hive;
  v10 = v11;
  if( v11 >= 0 )
  {
    CmpAttachToRegistryProcess(&ApcState);
    v7 = 1;
    CmpLockRegistry();
    HvLockHiveFlusherExclusive(a1);
    if( (*(_DWORD *)(a1 + 160) & 4) != 0 )
    {
LABEL_5:
      v10 = -1073741611;
      goto LABEL_18;
    }
    if( (*(_DWORD *)(a1 + 4152) & 0x20) != 0 )
      goto LABEL_7;
    if( a1 == *(&stru_140C00F40 + 70) )
    {
      v10 = CmpPreserveSystemHiveData(a1, (__int64)v12);
      if( v10 < 0 )
      {
LABEL_18:
        HvUnlockHiveFlusherExclusive(a1);
        CmpUnlockRegistry();
        if( v8 )
          CmpFinishBeingActiveFlusherAndReconciler((_EX_PUSH_LOCK *)a1);
        goto LABEL_20;
      }
    }
    HvUnlockHiveFlusherExclusive(a1);
    CmpUnlockRegistry();
    v10 = CmpFlushHive((CMHIVE *)v12, 0xCui64);
    if( v10 >= 0 )
    {
      CmpDetachFromRegistryProcess(&ApcState);
      v7 = 0;
      CmpBecomeActiveFlusherAndReconciler((PCMHIVE)a1);
      v8 = 1;
      CmpLockRegistry();
      HvLockHiveFlusherExclusive(a1);
      if( (*(_DWORD *)(a1 + 160) & 4) != 0 )
        goto LABEL_5;
      if( (*(_DWORD *)(a1 + 4152) & 0x20) == 0 )
      {
        v10 = CmpCmdRenameHive(
                *(PVOID *)(a1 + 1536),
                (_OBJECT_NAME_INFORMATION *)ObjectInformation,
                (_UNICODE_STRING *)a4,
                0x200ui64,
                0);
        if( v10 >= 0 )
        {
          *(_DWORD *)(a1 + 160) |= 4u;
          v10 = CmpCmdRenameHive(*(PVOID *)&v12[1].Signature, 0i64, ObjectInformation, 0i64, 0);
          if( v10 < 0 || (v10 = ZwFlushBuffersFile(*(VOID **)&v12[1].Signature, &IoStatusBlock), v10 < 0) )
          {
            if( (int)CmpCmdRenameHive(*(PVOID *)(a1 + 1536), 0i64, ObjectInformation, 0i64, 0) < 0 )
              v10 = -1073741492;
          }
        }
        goto LABEL_18;
      }
LABEL_7:
      v10 = -1073741811;
      goto LABEL_18;
    }
  }
LABEL_20:
  if( v12 )
  {
    if( !v7 )
    {
      CmpAttachToRegistryProcess(&ApcState);
      v7 = 1;
    }
    if( v10 >= 0 )
    {
      *(_OWORD *)&v12[1].Signature = 0i64;
      *(_OWORD *)&v12[1].ReleaseCellRoutine = 0i64;
      *(_OWORD *)&v12[1].Free = 0i64;
    }
    CmpDestroyHive(v12);
  }
  if( v7 )
    CmpDetachFromRegistryProcess(&ApcState);
  CmSiFreeMemory(TransientPoolWithTag);
  return(unsigned int)v10;
}

Referenced by: