CmpSearchKeyControlBlockTreeEx

char __fastcall CmpSearchKeyControlBlockTreeEx(
        __int64 (__fastcall *a1)(ULONG_PTR, ULONG_PTR, __int64, __int64),
        ULONG_PTR a2,
        __int64 a3,
        __int64 a4,
        char a5){
  __int64 v5; 
  unsigned int v6; 
  char v8; 
  unsigned int v9; 
  __int64 v10; 
  UINT64 v11; 
  _QWORD *v12; 
  __int64 *v13; 
  __int64 v14; 
  UINT64 v15; 
  __int64 v16; 
  int v17; 
  unsigned int v19; 
  _QWORD *v20; 
  __int64 v24; 
  KAPC_STATE ApcState; 
  v5 = *(_QWORD *)(a2 + 1640);
  v6 = *(_DWORD *)(a2 + 1648);
  v24 = v5;
  memset(&ApcState, 0, sizeof(ApcState));
  v19 = v6;
  CmpAttachToRegistryProcess(&ApcState);
  v8 = 0;
  v9 = 0;
  if( !v6 )
  {
LABEL_35:
    KiUnstackDetachProcess(&ApcState, 0i64);
    return 1;
  }
  while( 1 )
  {
    v10 = 24i64 * v9;
    if( a5 )
    {
      v11 = v10 + *(_QWORD *)(a2 + 1640);
      ExAcquirePushLockExclusiveEx(v11, 0i64);
      *(_QWORD *)(v11 + 8) = KeGetCurrentThread();
      if( !CmpReferenceHive((_CMHIVE *)a2) )
        KeBugCheckEx(0x51u, 0x17ui64, a2, 0xBui64, v9);
    }
    v12 = (_QWORD *)(v10 + 16 + v5);
    v20 = v12;
    v13 = v12;
    v14 = *v12;
    if( *v12 )
      break;
LABEL_24:
    if( a5 )
      CmpUnlockHashEntryByIndex((PVOID)a2, v9);
    if( ++v9 >= v6 )
      goto LABEL_35;
    v5 = v24;
  }
  while( 1 )
  {
    v15 = v14 - 16;
    if( a5 )
      CmpLockKcbExclusive(v14 - 16);
    if( !*(_QWORD *)v15 )
    {
      CmpRemoveFromDelayedClose(v15);
      CmpCleanUpKcbCacheWithLock((_CM_KEY_CONTROL_BLOCK *)v15, a3);
      if( a5 )
      {
        CmpUnlockKcb(v15);
      }
      else if( (*(_DWORD *)(v15 + 8) & 0x80000) != 0 )
      {
        CmpFreeKeyControlBlock((_CM_KEY_CONTROL_BLOCK *)v15);
      }
      v13 = v12;
      goto LABEL_22;
    }
    v16 = *(_QWORD *)(v15 + 24);
    v17 = a1(v15, a2, a3, a4);
    if( v17 == 1 )
      break;
    if( v17 == 3 )
    {
      if( a5 )
        CmpUnlockKcb(v15);
      goto LABEL_34;
    }
    if( v17 == 2 )
    {
      if( a5 )
        CmpUnlockKcb(v15);
      *v13 = v16;
    }
    else
    {
      v13 = (__int64 *)(v15 + 24);
      if( a5 )
        CmpUnlockKcb(v15);
    }
    v12 = v20;
LABEL_22:
    v14 = *v13;
    if( !*v13 )
    {
      v6 = v19;
      goto LABEL_24;
    }
  }
  if( a5 )
    CmpUnlockKcb(v15);
  v8 = 1;
LABEL_34:
  CmpUnlockHashEntryByIndex((PVOID)a2, v9);
  return v8;
}

Referenced by: