SmKmKeyGenNewKey

__int64 __fastcall SmKmKeyGenNewKey(ULONG_PTR BugCheckParameter2, void *Src, ULONG cbBuffer){
  __int64 v3; 
  __int64 v4; 
  INT64 NonPaged; 
  __int64 v8; 
  int v9; 
  UINT8 *v10; 
  int v11; 
  _ETHREAD *CurrentThread; 
  __int64 *v13; 
  __int64 v14; 
  HANDLE v15; 
  _WORD *v16; 
  __int64 v17; 
  __int64 v18; 
  struct _UNICODE_STRING ValueName; 
  HANDLE KeyHandle; 
  v3 = cbBuffer;
  KeyHandle = 0i64;
  v4 = -1i64;
  ValueName = 0i64;
  do
    ++v4;
  while( *((_WORD *)Src + v4) );
  NonPaged = SSHSupportAllocateNonPaged(cbBuffer + 42 + 2 * (_DWORD)v4, 0x474B6D73u);
  v8 = NonPaged;
  if( !NonPaged )
    return(unsigned int)-1073741670;
  memset(NonPaged, 0i64);
  *(_QWORD *)(v8 + 24) = v8 + 40;
  v10 = (UINT8 *)(v3 + v8 + 40);
  *(_DWORD *)(v8 + 32) = v3;
  *(_QWORD *)(v8 + 16) = v10;
  memmove(v10, (UINT8 *)Src, 2i64 * (unsigned int)v4);
  if( !*(_QWORD *)(BugCheckParameter2 + 32) )
    goto LABEL_8;
  v11 = SmKmKeyGenLoadKey((_UNICODE_STRING *)(BugCheckParameter2 + 24), v8, &KeyHandle);
  v9 = v11;
  if( v11 >= 0 )
  {
LABEL_9:
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx(BugCheckParameter2, 0i64);
    if( !SmKmKeyGenKeyFind(BugCheckParameter2, (unsigned __int16 *)Src) )
    {
      v13 = (__int64 *)(BugCheckParameter2 + 8);
      v14 = *(_QWORD *)(BugCheckParameter2 + 8);
      if( *(_QWORD *)(v14 + 8) != BugCheckParameter2 + 8 )
        __fastfail(3u);
      v15 = KeyHandle;
      *(_QWORD *)v8 = v14;
      *(_QWORD *)(v8 + 8) = v13;
      *(_QWORD *)(v14 + 8) = v8;
      *v13 = v8;
      if( v15 )
      {
        if( *(_QWORD *)(v8 + 16) )
        {
          v16 = *(_WORD **)(v8 + 16);
          v17 = 0x7FFFi64;
          do
          {
            if( !*v16 )
              break;
            ++v16;
            --v17;
          }
          while( v17 );
          v18 = (0x7FFF - v17) & ((unsigned __int128)-(__int128)(unsigned __int64)v17 >> 64);
          if( v17 )
          {
            ValueName.Buffer = *(wchar_t **)(v8 + 16);
            ValueName.Length = 2 * v18;
            ValueName.MaximumLength = 2 * v18 + 2;
          }
        }
        ZwDeleteValueKey(v15, &ValueName);
      }
      v8 = 0i64;
    }
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
    KeAbPostRelease((PVOID)BugCheckParameter2);
    KeLeaveCriticalRegion();
    v9 = 0;
    goto LABEL_24;
  }
  if( v11 == -1073741772 )
  {
LABEL_8:
    v9 = SmCrGenRandom(*(_UNICODE_STRING **)(v8 + 24), (UINT64 *)(unsigned int)v3);
    if( v9 >= 0 )
      goto LABEL_9;
  }
LABEL_24:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( v8 )
    CmSiFreeMemory((PPRIVILEGE_SET)v8);
  return(unsigned int)v9;
}

Referenced by: