CmpCopyMergeOfLayeredKeyNode

INT64 __fastcall CmpCopyMergeOfLayeredKeyNode(INT16 *a1, UINT64 rdx0, UINT64 r8_0, CHAR a4, UINT64 a5, UINT64 *a6){
  HSTORAGE_TYPE v6; 
  int v7; 
  __int16 v11; 
  INT64 v12; 
  INT16 v13; 
  INT64 EntryAtLayerHeight; 
  __int16 v15; 
  int v16; 
  INT64 v17; 
  int v18; 
  int EffectiveKeyNodeSemantics; 
  __int64 v20; 
  _HHIVE *v21; 
  char v22; 
  unsigned int v23; 
  unsigned int v24; 
  char *v25; 
  unsigned int v26; 
  UINT64 v27; 
  __int64 v28; 
  __int16 v29; 
  __int64 v30; 
  __int64 v31; 
  NTSTATUS SecurityDescriptorNode; 
  __int16 v33; 
  int v35; 
  _HV_GET_CELL_CONTEXT CellAddressContext; 
  VOID *CellAddress; 
  __int64 v38; 
  __int64 a2; 
  _HHIVE *SourceHive; 
  unsigned int SourceCell; 
  __int64 v42; 
  unsigned int a3; 
  v6 = (int)a5;
  v7 = r8_0;
  *((_WORD *)&CellAddressContext.BinContext + 1) = 0;
  CellAddressContext.Cell = -1;
  CellAddressContext.BinContext = 0;
  v42 = 0xFFFFFFFFi64;
  a2 = 0i64;
  a3 = 0;
  CellAddress = 0i64;
  if( (_DWORD)a5 == 2 )
  {
    if( (_DWORD)r8_0 == -1 )
      v6 = Stable;
    else
      v6 = (unsigned int)r8_0 >> 31;
  }
  v11 = *a1;
  v12 = 0i64;
  v38 = 0i64;
  v13 = v11;
  if( v11 >= 0 )
  {
    while( 1 )
    {
      EntryAtLayerHeight = CmpKeyNodeStackGetEntryAtLayerHeight((INT64)a1, v13);
      if( *(_DWORD *)(EntryAtLayerHeight + 8) != v16 )
        break;
      v13 = v15 - 1;
      if( v13 < 0 )
        goto LABEL_5;
    }
    v12 = EntryAtLayerHeight;
    v38 = EntryAtLayerHeight;
  }
LABEL_5:
  CmpGetSecurityCellForKeyNodeStack(a1, &a2, &a3);
  SourceHive = 0i64;
  SourceCell = -1;
  LOWORD(a5) = 0;
  if( (a4 & 1) != 0 && v11 >= 0 )
  {
    do
    {
      v17 = CmpKeyNodeStackGetEntryAtLayerHeight((INT64)a1, v11);
      if( *(_DWORD *)(v17 + 8) != v18 )
      {
        EffectiveKeyNodeSemantics = CmpGetEffectiveKeyNodeSemantics(*(_QWORD *)v17, *(_QWORD *)(v17 + 16));
        if( EffectiveKeyNodeSemantics == 1 )
          break;
        if( *(char *)(v20 + 13) >= v22 )
        {
          SourceCell = *(_DWORD *)(v20 + 48);
          LOWORD(a5) = *(_WORD *)(v20 + 74);
          SourceHive = v21;
          break;
        }
        if( EffectiveKeyNodeSemantics )
          break;
      }
      --v11;
    }
    while( v11 >= 0 );
  }
  v23 = *(unsigned __int16 *)(*(_QWORD *)(v12 + 16) + 72i64) + 76;
  v24 = HvAllocateCell((_HHIVE *)rdx0, v23, v6, &CellAddress, &CellAddressContext);
  v25 = (char *)CellAddress;
  v26 = v24;
  if( v24 == -1 )
  {
LABEL_31:
    SecurityDescriptorNode = -1073741670;
    goto LABEL_17;
  }
  v27 = v23;
  v28 = v38;
  memmove((UINT8 *)CellAddress, *(UINT8 **)(v38 + 16), v27);
  v25[12] = 0;
  v25[13] = v25[13] & 0x7C | 0x80;
  *((_DWORD *)v25 + 4) = v7;
  *(_QWORD *)(v25 + 20) = 0i64;
  *((_DWORD *)v25 + 7) = -1;
  *((_QWORD *)v25 + 4) = 0xFFFFFFFFi64;
  *((_DWORD *)v25 + 10) = -1;
  *((_DWORD *)v25 + 11) = -1;
  *((_DWORD *)v25 + 12) = -1;
  *((_WORD *)v25 + 26) = 0;
  *((_QWORD *)v25 + 7) = 0i64;
  *((_QWORD *)v25 + 8) = 0i64;
  *((_WORD *)v25 + 37) = 0;
  v29 = *(_WORD *)(*(_QWORD *)(v28 + 16) + 2i64) & 0xFFBF;
  *((_WORD *)v25 + 1) = v29;
  if( v7 == -1 )
    *((_WORD *)v25 + 1) = v29 | 0xC;
  v30 = a2;
  v31 = (*(__int64(__fastcall **)(__int64, _QWORD, __int64 *))(a2 + 8))(a2, a3, &v42);
  ExAcquirePushLockExclusiveEx(rdx0 + 1776, 0i64);
  SecurityDescriptorNode = CmpGetSecurityDescriptorNode(
                             (_HHIVE *)rdx0,
                             v26,
                             (_CM_KEY_NODE *)v25,
                             (PVOID)(v31 + 20),
                             0,
                             (UINT64 *)(v25 + 44));
  ExReleasePushLockEx(rdx0 + 1776, 0i64);
  (*(void(__fastcall **)(__int64, __int64 *))(v30 + 16))(v30, &v42);
  if( SecurityDescriptorNode >= 0 )
  {
    v33 = a5;
    if( !(_WORD)a5 )
    {
LABEL_16:
      SecurityDescriptorNode = 0;
      *(_DWORD *)a6 = v26;
      v26 = -1;
      goto LABEL_17;
    }
    v35 = CmpCopyCell(SourceHive, SourceCell, (_HHIVE *)rdx0, v6);
    if( v35 != -1 )
    {
      *((_DWORD *)v25 + 12) = v35;
      *((_WORD *)v25 + 37) = v33;
      goto LABEL_16;
    }
    goto LABEL_31;
  }
LABEL_17:
  if( v25 )
    (*(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(rdx0 + 16))(rdx0, &CellAddressContext);
  if( v26 != -1 )
    CmpFreeKeyByCell((_HHIVE *)rdx0, v26, 0);
  return(unsigned int)SecurityDescriptorNode;
}

Referenced by: