CmCreateKey

__int64 __fastcall CmCreateKey(
        _QWORD *a1,
        int a2,
        _OBJECT_ATTRIBUTES *a3,
        __int64 a4,
        __int128 *a5,
        int a6,
        _DWORD *a7,
        __int64 a8){
  __int64 v11; 
  unsigned int v12; 
  char PreviousMode; 
  INT64 v14; 
  const VOID *v15; 
  __int64 v16; 
  __int64 v17; 
  unsigned __int64 ObjectName; 
  int v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  _PRIVILEGE_SET *TransientPoolWithQuotaTag; 
  _PRIVILEGE_SET *v24; 
  NTSTATUS v25; 
  void *RootDirectory; 
  char v28; 
  __int64 v29; 
  UINT64 DesiredAccess; 
  char v31; 
  BOOL v32; 
  unsigned int v33; 
  _HANDLE Handle[2]; 
  PPRIVILEGE_SET Privileges; 
  _UNICODE_STRING v36; 
  PVOID Object; 
  __int64 v38; 
  __int128 v39; 
  int v40; 
  size_t Size[2]; 
  _QWORD *v42; 
  _OBJECT_ATTRIBUTES *v43; 
  _DWORD *v44; 
  __int128 v45; 
  _UNICODE_STRING v46; 
  unsigned __int64 v47; 
  INT64 ParseContext[38]; 
  __int128 TimeStamp[2]; 

  v42 = a1;
  v43 = a3;
  v11 = (__int64)a5;
  v44 = a7;
  *(_QWORD *)Handle = 0i64;
  v36 = 0i64;
  v39 = 0i64;
  Privileges = 0i64;
  v40 = 0;
  memset(TimeStamp, 0, sizeof(TimeStamp));
  v38 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
    EtwGetKernelTraceTimestamp((_LARGE_INTEGER *)TimeStamp, 0x20000ui64);
  memset(ParseContext, 0i64, 0x128u);
  LODWORD(ParseContext[12]) = -1;
  ParseContext[19] = (INT64)&ParseContext[18];
  ParseContext[18] = (INT64)&ParseContext[18];
  memset(&ParseContext[27], 0i64, 0x50u);
  HIDWORD(ParseContext[3]) = a2 & 0x300;
  v12 = a2 & 0xFFFFFCFF;
  v33 = v12;
  v32 = CmpAcquireShutdownRundown();
  if( v32 )
  {
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    v31 = PreviousMode;
    if( PreviousMode == 1 )
    {
      if( a5 )
      {
        v45 = 0i64;
        if( (unsigned __int64)a5 >= 0x7FFFFFFF0000i64 )
          v11 = 0x7FFFFFFF0000i64;
        v14 = *(unsigned int *)v11;
        LODWORD(v45) = v14;
        v15 = *(const VOID **)(v11 + 8);
        *((_QWORD *)&v45 + 1) = v15;
        v39 = v45;
        if( (_WORD)v14 )
        {
          if( ((unsigned __int8)v15 & 1) != 0 )
            ExRaiseDatatypeMisalignment();
          v22 = (unsigned __int64)v15 + (unsigned __int16)v14;
          if( v22 > 0x7FFFFFFF0000i64 || v22 < (unsigned __int64)v15 )
            MEMORY[0x7FFFFFFF0000] = 0;
        }
        if( (v14 & 1) != 0 )
        {
          v25 = -1073741811;
          goto LABEL_45;
        }
        if( (_WORD)v14 )
        {
          *(_QWORD *)Size = (unsigned __int16)v14;
          TransientPoolWithQuotaTag = (_PRIVILEGE_SET *)CmpAllocateTransientPoolWithQuotaTag(
                                                          v14,
                                                          (unsigned __int16)v14,
                                                          0x78634D43ui64);
          Privileges = TransientPoolWithQuotaTag;
          if( !TransientPoolWithQuotaTag )
          {
            v25 = -1073741670;
            goto LABEL_45;
          }
          v24 = TransientPoolWithQuotaTag;
          memmove(TransientPoolWithQuotaTag, v15, Size[0]);
          *((_QWORD *)&v39 + 1) = v24;
        }
        v12 = v33;
      }
      v16 = (__int64)a1;
      if( (unsigned __int64)a1 >= 0x7FFFFFFF0000i64 )
        v16 = 0x7FFFFFFF0000i64;
      *(_QWORD *)v16 = 0i64;
      if( a7 )
      {
        v17 = (__int64)a7;
        if( (unsigned __int64)a7 >= 0x7FFFFFFF0000i64 )
          v17 = 0x7FFFFFFF0000i64;
        *(_DWORD *)v17 = *(_DWORD *)v17;
      }
      if( ((unsigned __int8)a3 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      ObjectName = (unsigned __int64)a3->ObjectName;
      v47 = ObjectName;
      v46 = 0i64;
      if( ObjectName >= 0x7FFFFFFF0000i64 )
        ObjectName = 0x7FFFFFFF0000i64;
      v19 = *(_DWORD *)ObjectName;
      *(_DWORD *)&v46.Length = v19;
      v20 = *(_QWORD *)(ObjectName + 8);
      v46.Buffer = (wchar_t *)v20;
      v36 = v46;
      if( (_WORD)v19 )
      {
        if( (v20 & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v21 = v20 + (unsigned __int16)v19;
        if( v21 > 0x7FFFFFFF0000i64 || v21 < v20 )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      if( (v36.Length & 1) != 0 )
      {
        v25 = -1073741811;
        goto LABEL_45;
      }
      RootDirectory = a3->RootDirectory;
      *(_QWORD *)Handle = RootDirectory;
      PreviousMode = 1;
    }
    else
    {
      if( a5 )
        v39 = *a5;
      v36 = *a3->ObjectName;
      RootDirectory = a3->RootDirectory;
      *(_QWORD *)Handle = RootDirectory;
    }
    if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && RootDirectory )
    {
      v28 = KeGetCurrentThread()->PreviousMode;
      Object = 0i64;
      if( ObReferenceObjectByHandle(*(VOID **)Handle, 0i64, (_OBJECT_TYPE *)CmKeyObjectType, v28, &Object, 0i64) >= 0 )
      {
        v38 = *((_QWORD *)Object + 1);
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      }
      PreviousMode = v31;
    }
    if( (a6 & 0x100001F) == a6 )
    {
      LODWORD(ParseContext[3]) = a6;
      LODWORD(ParseContext[0]) = 1;
      ParseContext[1] = *((_QWORD *)&v39 + 1);
      WORD2(ParseContext[0]) = v39;
      ParseContext[9] = a8;
      LODWORD(DesiredAccess) = v12;
      v25 = ObOpenObjectByName(
              a3,
              (_OBJECT_TYPE *)CmKeyObjectType,
              PreviousMode,
              0i64,
              DesiredAccess,
              ParseContext,
              (VOID **)Handle);
      if( v25 >= 0 )
      {
        *a1 = *(_QWORD *)Handle;
        if( a7 )
          *a7 = ParseContext[4];
      }
    }
    else
    {
      v25 = -1073741811;
    }
  }
  else
  {
    if( HvShutdownComplete && (*(&stru_140C23628 + 2336) & 8) != 0 )
      KeBugCheckEx(0x51u, (PVOID)0xE, (PVOID)1, a3, 0i64);
    v25 = -1073741431;
  }
LABEL_45:
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    v29 = v38;
    LOBYTE(v29) = 10;
    (*(void(__fastcall **)(__int64, __int128 *, _QWORD, _QWORD, __int64, _UNICODE_STRING *))((char *)&NlsMbCodePageTag
                                                                                            + 7))(
      v29,
      TimeStamp,
      (unsigned int)v25,
      0i64,
      v38,
      &v36);
  }
  if( Privileges )
    CmSiFreeMemory(Privileges);
  CmpCleanupParseContext((INT64)ParseContext, 0);
  if( v32 )
    CmpReleaseShutdownRundown();
  return(unsigned int)v25;
}

Referenced by: