CmpVEExecuteParseLogic

INT64 __fastcall CmpVEExecuteParseLogic(INT64 a1, __m128i *a2, INT64 a3, __m128i *a4, CHAR a5, INT64 a6){
  __int64 v10; 
  __int16 i; 
  __int64 v12; 
  INT64 result; 
  int *v14; 
  char v15; 
  void **p_SubjectContext; 
  void *v17; 
  void *v18; 
  bool v19; 
  bool v20; 
  int v21; 
  int v22; 
  _EPROCESS *CurrentThreadProcess; 
  PVOID TokenInformation; 
  int v25; 
  __int16 v26; 
  __int16 v27; 
  __int64 v28[3]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  if( !CmpVEEnabled || (*(_DWORD *)(a3 + 24) & 0x10) != 0 || *(_WORD *)(a1 + 66) )
    return 3221226097i64;
  v10 = *(_QWORD *)(a1 + 32);
  if( v10 == CmpMasterHive )
    return 3221226097i64;
  v26 = 0;
  v27 = 0;
  v28[1] = 0i64;
  v25 = 0;
  v28[2] = 0i64;
  v28[0] = a1;
  for( i = 0; i >= 0; --i )
  {
    if( i >= 2 )
      v12 = *(_QWORD *)(8i64 * i - 16);
    else
      v12 = v28[i];
    if( *(_WORD *)(v12 + 66) && *(_BYTE *)(v12 + 65) == 1 )
      goto LABEL_14;
    if( *(_DWORD *)(v12 + 40) != -1 )
      break;
  }
  if( (*(_DWORD *)(v10 + 4152) & 0x10) == 0 && (*(_DWORD *)(a1 + 184) & 0x2000000) == 0 )
    return 3221226097i64;
LABEL_14:
  v14 = (int *)(a3 + 16);
  v15 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( a3 != -16 && (*v14 & 1) != 0 )
  {
    v20 = (*v14 & 2) != 0;
  }
  else
  {
    if( !a5 )
      return 3221226097i64;
    if( a6 )
    {
      p_SubjectContext = (void **)a6;
    }
    else
    {
      CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
      SeCaptureSubjectContextEx((_ETHREAD *)KeGetCurrentThread(), CurrentThreadProcess, &SubjectContext);
      p_SubjectContext = (void **)&SubjectContext;
      v15 = 1;
    }
    v17 = *p_SubjectContext;
    LODWORD(TokenInformation) = 0;
    if( v17 )
      v18 = v17;
    else
      v18 = p_SubjectContext[2];
    v19 = 1;
    if( !v17 )
    {
      SeQueryInformationToken(v18, TokenVirtualizationEnabled, &TokenInformation);
      if( (_DWORD)TokenInformation )
        v19 = 0;
    }
    v20 = v19;
    if( v14 )
    {
      v21 = *v14;
      if( v19 )
      {
        v22 = v21 | 3;
      }
      else
      {
        v22 = v21 | 5;
        v20 = 0;
      }
      *v14 = v22;
    }
    if( v15 )
      SeReleaseSubjectContext(&SubjectContext);
  }
  if( v20 || (*(_DWORD *)a3 & 8) != 0 )
    return 3221226097i64;
  if( (*(_DWORD *)(a3 + 160) & 1) == 0 )
  {
    CmpAttachToRegistryProcess((KAPC_STATE *)(a3 + 168));
    *(_DWORD *)(a3 + 160) |= 1u;
  }
  if( (*(_DWORD *)(a1 + 184) & 0x2000000) == 0 )
    return CmpVEExecuteRealStoreParseLogic(a1, a2, (_DWORD *)a3, a4, a6);
  CmpVEExecuteVirtualStoreParseLogic((_CM_KEY_CONTROL_BLOCK *)a1, (_UNICODE_STRING *)a2);
  return result;
}

Referenced by: