CmpSnapshotTxOwnerArray
INT64 __fastcall CmpSnapshotTxOwnerArray(INT64 a1, UINT64 *a2, VOID ***a3){
__int64 v3;
unsigned int v8;
__int64 v9;
VOID **PoolWithTag;
__int64 v11;
VOID **v12;
__int64 v13;
void *v14;
VOID **v15;
__int64 v16;
__int64 v17;
void *v18;
v3 = 0i64;
if( !*(_DWORD *)a1 )
return 3221225485i64;
v8 = *(_DWORD *)a1 & 0x7FFFFFFF;
*(_DWORD *)a2 = 0;
v9 = v8;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 8i64 * v8, 909397315i64);
*a3 = PoolWithTag;
if( !PoolWithTag )
return 3221225626i64;
memset(PoolWithTag, 0i64, 8 * v8);
if( v8 == 1 )
{
v11 = *(_QWORD *)(a1 + 8);
v12 = *a3;
v13 = *(_QWORD *)(v11 + 56);
if( (*(_DWORD *)(v13 + 48) & 0x80u) == 0 )
{
*v12 = *(VOID **)(v13 + 72);
v14 = **a3;
}
else
{
*v12 = *(VOID **)(v13 + 56);
v14 = (void *)(*(_QWORD *)(*(_QWORD *)(v11 + 56) + 56i64) & 0xFFFFFFFFFFFFFFFEui64);
}
ObfReferenceObject(v14);
}
else if( v8 )
{
do
{
v15 = *a3;
v16 = *(_QWORD *)(v3 * 8 + *(_QWORD *)(a1 + 8));
v17 = *(_QWORD *)(v16 + 56);
if( (*(_DWORD *)(v17 + 48) & 0x80u) == 0 )
{
v15[v3] = *(VOID **)(v17 + 72);
v18 = (*a3)[v3];
}
else
{
v15[v3] = *(VOID **)(v17 + 56);
v18 = (void *)(*(_QWORD *)(*(_QWORD *)(v16 + 56) + 56i64) & 0xFFFFFFFFFFFFFFFEui64);
}
ObfReferenceObject(v18);
++v3;
--v9;
}
while( v9 );
}
*(_DWORD *)a2 = v8;
return 0i64;
}Referenced by:
CmDeleteValueKey
CmSetValueKey
CmpCreateChild
CmpSetKeySecurity