CmpRemoveSubKeyFromList

UINT8 __stdcall CmpRemoveSubKeyFromList(_HHIVE *Hive, UINT64 *ListCell, UINT64 TargetKey){
  int v3; 
  _WORD *v6; 
  unsigned int v7; 
  _CELL_DATA *v8; 
  UINT8 v9; 
  __int64 v10; 
  unsigned int v11; 
  _CELL_DATA *(__fastcall *GetCellRoutine)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  _WORD *v13; 
  NTSTATUS SubKeyInRoot; 
  __int16 v15; 
  _CELL_DATA *(__fastcall *v16)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  struct _UNICODE_STRING *p_DestinationString; 
  int SubKeyInLeaf; 
  __int64 v19; 
  bool v20; 
  unsigned int v21; 
  unsigned int v22; 
  UINT64 v23; 
  UINT8 *v24; 
  UINT8 *v25; 
  __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v31; 
  int v32; 
  int v33; 
  int v34[2]; 
  struct _UNICODE_STRING DestinationString; 
  __int64 a5; 
  UINT64 *v37; 
  ULONG_PTR BugCheckParameter3; 
  v37 = ListCell;
  v3 = -1;
  v34[0] = -1;
  v34[1] = 0;
  v31 = 0xFFFFFFFFi64;
  v32 = -1;
  v33 = 0;
  LODWORD(a5) = 0;
  v6 = 0i64;
  DestinationString = 0i64;
  v7 = TargetKey;
  RtlInitUnicodeString(&DestinationString, 0i64, TargetKey);
  v8 = Hive->GetCellRoutine(Hive, v7, v34);
  if( !v8 )
    return 0;
  v10 = v8->u.KeyNode.Flags & 0x20;
  DestinationString.Length = v8->u.KeyNode.NameLength;
  DestinationString.MaximumLength = DestinationString.Length;
  DestinationString.Buffer = v8->u.KeyNode.Name;
  Hive->ReleaseCellRoutine(Hive, (_HV_GET_CELL_CONTEXT *)v34);
  v11 = *(_DWORD *)ListCell;
  GetCellRoutine = Hive->GetCellRoutine;
  LODWORD(BugCheckParameter3) = v11;
  v13 = (_WORD *)GetCellRoutine(Hive, v11, (_HV_GET_CELL_CONTEXT *)&v31);
  if( !v13 )
    return 0;
  SubKeyInRoot = 0x80000000;
  if( *v13 != 26994 )
    goto LABEL_9;
  SubKeyInRoot = CmpFindSubKeyInRoot(Hive, v13);
  if( SubKeyInRoot < 0 )
  {
LABEL_6:
    v9 = 0;
    goto LABEL_24;
  }
  v32 = v31;
  v6 = v13;
  v15 = WORD2(v31);
  v31 = 0i64;
  LOWORD(v33) = v15;
  v16 = Hive->GetCellRoutine;
  LODWORD(BugCheckParameter3) = a5;
  LODWORD(v31) = -1;
  v13 = (_WORD *)v16(Hive, a5, (_HV_GET_CELL_CONTEXT *)&v31);
  if( v13 )
  {
LABEL_9:
    p_DestinationString = &DestinationString;
    if( (_WORD)v10 )
      p_DestinationString = 0i64;
    SubKeyInLeaf = CmpFindSubKeyInLeaf(
                     (INT64)Hive,
                     v13,
                     p_DestinationString,
                     (WCHAR **)((unsigned __int64)&DestinationString & -(__int64)((_WORD)v10 != 0)),
                     (__int64)&a5);
    v19 = (unsigned int)SubKeyInLeaf;
    if( SubKeyInLeaf < 0 )
      goto LABEL_6;
    v20 = v13[1]-- == 1;
    v21 = (unsigned __int16)v13[1];
    if( v20 )
    {
      Hive->ReleaseCellRoutine(Hive, (_HV_GET_CELL_CONTEXT *)&v31);
      v13 = 0i64;
      HvFreeCell((UINT64)Hive, (unsigned int)BugCheckParameter3);
      if( !v6 )
      {
LABEL_23:
        *(_DWORD *)v37 = v3;
        v9 = 1;
LABEL_24:
        if( v13 )
          Hive->ReleaseCellRoutine(Hive, (_HV_GET_CELL_CONTEXT *)&v31);
        goto LABEL_26;
      }
      v20 = v6[1]-- == 1;
      v22 = (unsigned __int16)v6[1];
      if( v20 )
      {
        Hive->ReleaseCellRoutine(Hive, (_HV_GET_CELL_CONTEXT *)&v32);
        v6 = 0i64;
        HvFreeCell((UINT64)Hive, v11);
        goto LABEL_23;
      }
      v3 = v11;
      if( SubKeyInRoot >= v22 )
        goto LABEL_23;
      v23 = 4i64 * (v22 - SubKeyInRoot);
      v24 = (UINT8 *)&v6[2 * (SubKeyInRoot + 1) + 2];
      v25 = (UINT8 *)&v6[2 * SubKeyInRoot + 2];
    }
    else
    {
      v3 = v11;
      if( (unsigned int)v19 >= v21 )
        goto LABEL_23;
      v26 = (unsigned int)(v19 + 1);
      v27 = v21 - (unsigned int)v19;
      v28 = v19;
      if( *v13 == 26988 )
      {
        v23 = 4 * v27;
        v29 = v19 + 1;
        v24 = (UINT8 *)&v13[2 * v26 + 2];
        v25 = (UINT8 *)&v13[2 * v29];
      }
      else
      {
        v23 = 8 * v27;
        v24 = (UINT8 *)&v13[4 * v26 + 2];
        v25 = (UINT8 *)&v13[4 * v28 + 2];
      }
    }
    memmove(v25, v24, v23);
    goto LABEL_23;
  }
  v9 = 0;
LABEL_26:
  if( v6 )
    Hive->ReleaseCellRoutine(Hive, (_HV_GET_CELL_CONTEXT *)&v32);
  return v9;
}

Referenced by: