CmpInitializePreloadedHive

INT64 __fastcall CmpInitializePreloadedHive(INT64 a1, INT64 a2){
  int v4; 
  VOID **PoolWithTag; 
  VOID **v6; 
  int v7; 
  int v8; 
  VOID **v9; 
  wchar_t *v10; 
  int v11; 
  int Hive; 
  int v13; 
  int v14; 
  int v15; 
  _QWORD *v16; 
  _QWORD *v17; 
  int v19; 
  _WCHAR *SystemRelativeRegistryHiveFilePath; 
  PVOID BugCheckParameter4; 
  UINT64 Flags; 
  INT64 a11; 
  PVOID v24; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING LinkName; 
  char BugCheckParameter3[432]; 
  char v28; 

  memset(BugCheckParameter3, 0i64, sizeof(BugCheckParameter3));
  v4 = 4096;
  v24 = 0i64;
  LOBYTE(a11) = 0;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 538987843i64);
  v6 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_33;
  v7 = *(_DWORD *)(a1 + 24);
  *(_QWORD *)&Destination.Length = 0x10000000i64;
  Destination.Buffer = (wchar_t *)PoolWithTag;
  if( (v7 & 0x36) != 0 )
  {
    RtlAppendUnicodeToString(&Destination, *(WCHAR **)(a1 + 16));
    v19 = *(_DWORD *)(a1 + 24);
    if( (v19 & 2) == 0 )
    {
      if( (v19 & 4) != 0 )
        v4 = 0x2000;
      else
        v4 = (v19 & 0x20) != 0 ? 0x200000 : 1;
    }
  }
  else if( (v7 & 0x80) != 0 )
  {
    SystemRelativeRegistryHiveFilePath = CmpGetSystemRelativeRegistryHiveFilePath(*(_WCHAR **)(a1 + 16));
    RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\DriverStores\\");
    RtlAppendUnicodeToString(&Destination, *(WCHAR **)(a1 + 48));
    RtlAppendUnicodeToString(&Destination, SystemRelativeRegistryHiveFilePath);
    v4 = 0x400000;
    if( *(&stru_140CF2E80 + 1656) && !*(&stru_140CF2E80 + 1868) )
      v4 = 4194305;
  }
  else
  {
    RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\SystemRoot\\System32\\Config\\");
    RtlAppendUnicodeToString(&Destination, *(WCHAR **)(a1 + 16));
    v4 = 0x4000;
  }
  v8 = *(_DWORD *)(a1 + 24) & 0x100;
  v9 = ExAllocatePoolWithTag(1ui64, Destination.Length + 2i64, 538987843i64);
  v10 = (wchar_t *)v9;
  if( !v9 )
LABEL_33:
    KeBugCheckEx(0x74u, (PVOID)3, (PVOID)4, 0i64, (PVOID)0xFFFFFFFFC000009Ai64);
  memmove(v9, Destination.Buffer, Destination.Length);
  ExFreePoolWithTag(v6, 0);
  v10[(unsigned __int64)Destination.Length >> 1] = 0;
  v11 = *(_DWORD *)(a1 + 24);
  Destination.MaximumLength = Destination.Length + 2;
  Destination.Buffer = v10;
  LODWORD(Flags) = 5832712;
  Hive = CmpCreateHive(
           (INT64)&v24,
           1ui64,
           (32 * (v11 & 8)) | 0x12u,
           2ui64,
           *(_QWORD *)(a1 + 32),
           0i64,
           (INT64)&Destination,
           Flags,
           0i64,
           0i64,
           (INT64)&a11,
           (INT64)BugCheckParameter3);
  if( Hive < 0 )
    KeBugCheckEx(0x74u, (PVOID)3, (PVOID)5, BugCheckParameter3, (PVOID)Hive);
  CmpSetupLoggingState((INT64)v24, (UINT64 *)(a1 + 64));
  RtlInitUnicodeString((PUNICODE_STRING)((char *)v24 + 1816), v10);
  v13 = v4 | 0x1000000;
  if( !v8 )
    v13 = v4;
  *((_DWORD *)v24 + 40) |= v13 | 0x400;
  if( (_BYTE)a11 == 1 )
    *((_DWORD *)v24 + 40) |= 0x800u;
  if( BYTE4(NlsMbCodePageTag) )
    *((_DWORD *)v24 + 40) |= 0x8000u;
  if( *(&stru_140CF2E80 + 1656) && !*(&stru_140CF2E80 + 1868) && (*(_DWORD *)(a1 + 24) & 0x20) == 0 )
    *((_DWORD *)v24 + 40) |= 0x8000u;
  v14 = *(_DWORD *)(*((_QWORD *)v24 + 8) + 4088i64);
  *(&CmpDummyThreadEvent + 686) = v14;
  if( !CmSelfHeal )
  {
    BYTE3(NlsMbCodePageTag) = 0;
    if( (v14 & 4) != 0 )
      KeBugCheckEx(0x74u, (PVOID)3, (PVOID)6, v24, 0i64);
  }
  *(_QWORD *)&LinkName.Length = 0x800000i64;
  LinkName.Buffer = (wchar_t *)&v28;
  RtlAppendUnicodeToString(&LinkName, (WCHAR *)L"\\REGISTRY\\");
  RtlAppendUnicodeToString(&LinkName, *(WCHAR **)(a1 + 56));
  RtlAppendUnicodeToString(&LinkName, (WCHAR *)L"\\");
  RtlAppendUnicodeToString(&LinkName, *(WCHAR **)(a1 + 48));
  LODWORD(BugCheckParameter4) = 512;
  v15 = CmpLinkHiveToMaster(
          &LinkName,
          0i64,
          (_CMHIVE *)v24,
          0i64,
          (UINT64)BugCheckParameter4,
          0,
          0i64,
          (VOID *)a2,
          0i64,
          0i64,
          1u);
  if( v15 < 0 )
    KeBugCheckEx(0x74u, (PVOID)3, (PVOID)7, v24, (PVOID)v15);
  v16 = (_QWORD *)*(&CmpDummyThreadEvent + 259);
  v17 = (char *)v24 + 1616;
  if( (_UNKNOWN *)**(&CmpDummyThreadEvent + 259) != (_UNKNOWN *)((char *)&CmpDummyThreadEvent + 2064) )
    __fastfail(3u);
  *v17 = (char *)&CmpDummyThreadEvent + 2064;
  v17[1] = v16;
  *v16 = v17;
  *(&CmpDummyThreadEvent + 259) = v17;
  return 0i64;
}

Referenced by: