CmpDumpOneKeyBody

VOID __stdcall CmpDumpOneKeyBody(_CM_KEY_BODY *KeyBody, _UNICODE_STRING *Name, PVOID Context){
  __int64 v3; 
  __int64 v4; 
  wchar_t *Buffer; 
  NTSTATUS v7; 
  PEPROCESS v8; 
  _DWORD *v9; 
  int v10; 
  _CM_KEY_BODY *v11; 

  v11 = KeyBody;
  v4 = v3;
  if( v3 )
  {
    v9 = *(_DWORD **)(v3 + 8);
    if( *(_UNICODE_STRING **)(v3 + 32) != Name )
    {
      v10 = *(unsigned __int16 *)Context + 24;
      *(_DWORD *)(v3 + 16) += v10;
      if( *(int *)(v3 + 20) >= 0 )
      {
        if( (unsigned int)(v10 + *(_DWORD *)(v3 + 24)) <= *(_DWORD *)v3 )
        {
          *(_QWORD *)&v9[6 * *v9 + 2] = Name[1].Buffer;
          LOWORD(v9[6 * *v9 + 4]) = *(_WORD *)Context;
          HIWORD(v9[6 * *v9 + 4]) = *(_WORD *)Context;
          *(_QWORD *)&v9[6 * *v9 + 6] = *(_QWORD *)(v3 + 40) - *(unsigned __int16 *)Context;
          memmove(*(VOID **)&v9[6 * *v9 + 6], *((const VOID **)Context + 1), *(unsigned __int16 *)Context);
          *(_QWORD *)(v4 + 40) -= *(unsigned __int16 *)Context;
          *(_DWORD *)(v4 + 24) += v10;
        }
        else
        {
          *(_DWORD *)(v3 + 20) = -2147483643;
        }
      }
      ++*v9;
    }
  }
  else
  {
    Buffer = Name[1].Buffer;
    v11 = 0i64;
    v7 = PsLookupProcessByProcessId(Buffer, (PEPROCESS *)&v11);
    v8 = (PEPROCESS)v11;
    if( v7 < 0 )
      v8 = 0i64;
    if( v8 )
      ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
  }
}

Referenced by: