CmpDoQueryKeyName

INT64 __fastcall CmpDoQueryKeyName(PVOID Object, INT64 a2, INT64 a3, UINT64 a4, INT64 a5){
  int v5; 
  UINT64 *v7; 
  UINT64 v8; 
  struct _UNICODE_STRING *p_UnicodeString; 
  char v10; 
  char v11; 
  _ETHREAD *CurrentThread; 
  UINT8 v13; 
  NTSTATUS v14; 
  int v15; 
  UINT8 *Buffer; 
  unsigned int v17; 
  unsigned int v18; 
  __int64 v19; 
  INT64 v20; 
  char v22; 
  unsigned int v23; 
  LIST_ENTRY ThList; 
  struct _UNICODE_STRING UnicodeString; 
  INT64 v27; 
  PVOID v28; 
  __int128 Argument; 
  __int128 v30; 
  __int128 v31; 
  __int64 v32; 
  KAPC_STATE ApcState; 
  v5 = a4;
  v23 = a4;
  v27 = a3;
  v7 = (UINT64 *)Object;
  v28 = Object;
  UnicodeString = 0i64;
  Argument = 0i64;
  v30 = 0i64;
  v31 = 0i64;
  v32 = 0i64;
  v8 = 0i64;
  p_UnicodeString = 0i64;
  v10 = 0;
  v22 = 0;
  v11 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  ThList.Blink = &ThList;
  ThList.Flink = &ThList;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  if( CmpCallBackCount && !ExIsResourceAcquiredSharedLite((PERESOURCE)&CmpRegistryLock) )
  {
    *(_QWORD *)&Argument = v7;
    *((_QWORD *)&Argument + 1) = a3;
    LODWORD(v30) = v5;
    *((_QWORD *)&v30 + 1) = a5;
    v14 = CmpCallCallBacks(RegNtPreQueryKeyName, &Argument, v13, RegNtPostQueryKeyName, v7, &ThList);
    v15 = v14;
    if( v14 < 0 )
    {
      if( v14 == -1073740541 )
        v15 = 0;
      goto LABEL_19;
    }
    v22 = 1;
  }
  CmpAttachToRegistryProcess(&ApcState);
  v11 = 1;
  CmpLockRegistry();
  v8 = v7[1];
  if( (v8 & 1) != 0 )
  {
    v8 ^= 1ui64;
  }
  else if( (v7[6] & 2) == 0 )
  {
    CmpLockKcbShared((_CM_KEY_CONTROL_BLOCK *)v8);
    v10 = 1;
  }
  v15 = CmpPerformKeyBodyDeletionCheck((__int64)v7, 0i64);
  if( v15 >= 0 )
  {
    if( CmpVEEnabled && (*(_DWORD *)(v8 + 184) & 0x1000000) != 0 )
    {
      if( CmVirtualKCBToRealPath((_CM_KEY_CONTROL_BLOCK *)v8, &UnicodeString) >= 0 )
        p_UnicodeString = &UnicodeString;
    }
    else
    {
      p_UnicodeString = CmpConstructName((_CM_KEY_CONTROL_BLOCK *)v8);
    }
    if( p_UnicodeString )
    {
      if( v10 )
      {
        CmpUnlockKcb(v8);
        v10 = 0;
      }
      CmpUnlockRegistry();
      CmpDetachFromRegistryProcess(&ApcState);
      v11 = 0;
      if( v23 <= 0x10 )
      {
        *(_DWORD *)a5 = p_UnicodeString->Length + 18;
        v15 = -1073741820;
      }
      else
      {
        Buffer = (UINT8 *)p_UnicodeString->Buffer;
        v17 = p_UnicodeString->Length + 2;
        *(_DWORD *)a5 = p_UnicodeString->Length + 18;
        if( v17 <= (unsigned __int64)v23 - 16 )
        {
          v15 = 0;
LABEL_18:
          v18 = v17 - 2;
          memmove((UINT8 *)(a3 + 16), Buffer, v18);
          v19 = v27;
          v20 = v27 + 16;
          *(_WORD *)(v20 + 2 * ((unsigned __int64)v18 >> 1)) = 0;
          *(_WORD *)v19 = v18;
          *(_WORD *)(v19 + 2) = v18;
          *(_QWORD *)(v19 + 8) = v20;
          v7 = (UINT64 *)Object;
          goto LABEL_19;
        }
        v17 = v23 - 16;
        v15 = -1073741820;
        if( v23 - 16 >= 2 )
          goto LABEL_18;
        v7 = (UINT64 *)Object;
      }
    }
    else
    {
      v15 = -1073741670;
    }
  }
LABEL_19:
  if( v10 )
    CmpUnlockKcb(v8);
  if( v11 )
  {
    CmpUnlockRegistry();
    CmpDetachFromRegistryProcess(&ApcState);
  }
  if( v22 )
    CmPostCallbackNotification(RegNtPostQueryKeyName, v7, (unsigned int)v15, &Argument, &ThList);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( UnicodeString.Buffer )
  {
    RtlFreeAnsiString(&UnicodeString);
  }
  else if( p_UnicodeString )
  {
    ExFreePoolWithTag(p_UnicodeString, 0x624E4D43u);
  }
  return(unsigned int)v15;
}

Referenced by: