CmpGetSystemControlValues

INT64 __fastcall CmpGetSystemControlValues(INT64 BaseBlock, INT64 a2, CHAR a3){
  wchar_t **v3; 
  int v6; 
  WCHAR v7; 
  unsigned int v8; 
  unsigned int ControlSet; 
  INT64 SubKeyByName; 
  WCHAR v11; 
  _CM_KEY_NODE *v12; 
  unsigned int v13; 
  _HHIVE *v14; 
  unsigned int v15; 
  unsigned int v16; 
  WCHAR v17; 
  _CM_KEY_NODE *v18; 
  unsigned int ValueByName; 
  unsigned int *v20; 
  unsigned int v21; 
  unsigned int *v22; 
  INT64 v23; 
  _HHIVE *v24; 
  unsigned int v25; 
  wchar_t *v26; 
  WCHAR v27; 
  _CM_KEY_NODE *v28; 
  BYTE v29[4]; 
  int v30[2]; 
  UINT64 LCIDPickedUp; 
  struct _UNICODE_STRING DestinationString; 
  int v33[2]; 
  ULONG_PTR *v34; 
  INT64 result[53]; 
  v3 = CmControlVector;
  v33[1] = 0;
  v29[1] = 0;
  LODWORD(LCIDPickedUp) = 0;
  v30[1] = 0;
  v33[0] = -1;
  v30[0] = -1;
  DestinationString = 0i64;
  memset((INT64)result, 0i64);
  memset((INT64)&CmControlHive, 0i64);
  CmpInitSecurityCache((__int64)&CmControlHive);
  HvHiveInitialize(&CmControlHive);
  v34 = &CmControlHive;
  qword_140D5B798 = (__int64)&v34;
  HvHiveStartMemoryBacked((INT64)&CmControlHive, 4ui64, 1i64, 0i64);
  if( v6 < 0 )
    KeBugCheckEx(0x74u, 1ui64, 1ui64, (ULONG_PTR)&CmControlHive, v6);
  qword_140D5B798 = 0i64;
  v8 = *(_DWORD *)(BaseBlock + 36);
  if( a3 == 1 )
  {
    SubKeyByName = ((__int64(__fastcall *)(ULONG_PTR *, _QWORD, int *))qword_140D5B768)(&CmControlHive, v8, v30);
    v28 = (_CM_KEY_NODE *)SubKeyByName;
    if( !SubKeyByName )
      return SubKeyByName;
    RtlInitUnicodeString(&DestinationString, L"ControlSetOverride", v27);
    SubKeyByName = CmpFindSubKeyByName((_HHIVE *)&CmControlHive, v28, &DestinationString);
    v13 = SubKeyByName;
    if( (_DWORD)SubKeyByName == -1 )
      return SubKeyByName;
  }
  else
  {
    RtlInitUnicodeString(&DestinationString, L"current", v7);
    ControlSet = CmpFindControlSet((UINT64)&CmControlHive, v8, &DestinationString, &v29[1]);
    if( ControlSet == -1 )
      KeBugCheckEx(0x74u, 1ui64, 2ui64, (ULONG_PTR)&CmControlHive, (ULONG_PTR)&DestinationString);
    SubKeyByName = ((__int64(__fastcall *)(ULONG_PTR *, _QWORD, int *))qword_140D5B768)(
                     &CmControlHive,
                     ControlSet,
                     v30);
    v12 = (_CM_KEY_NODE *)SubKeyByName;
    if( !SubKeyByName )
      return SubKeyByName;
    RtlInitUnicodeString(&DestinationString, L"control", v11);
    v13 = CmpFindSubKeyByName((_HHIVE *)&CmControlHive, v12, &DestinationString);
    if( v13 == -1 )
      KeBugCheckEx(0x74u, 1ui64, 3ui64, (ULONG_PTR)v12, (ULONG_PTR)&DestinationString);
  }
  ((void(__fastcall *)(ULONG_PTR *, int *))qword_140D5B770)(&CmControlHive, v30);
  if( CmControlVector[0] )
  {
    do
    {
      if( a3 != 1 || *((_BYTE *)v3 + 40) )
      {
        v15 = -1;
        v16 = CmpWalkPath((INT64)&CmControlHive, v13, *v3);
        if( v16 != -1 )
        {
          SubKeyByName = ((__int64(__fastcall *)(ULONG_PTR *, _QWORD, int *))qword_140D5B768)(&CmControlHive, v16, v30);
          v18 = (_CM_KEY_NODE *)SubKeyByName;
          if( !SubKeyByName )
            return SubKeyByName;
          RtlInitUnicodeString(&DestinationString, v3[1], v17);
          ValueByName = CmpFindValueByName((_HHIVE *)&CmControlHive, v18, &DestinationString);
          ((void(__fastcall *)(ULONG_PTR *, int *))qword_140D5B770)(&CmControlHive, v30);
          if( ValueByName != -1 )
          {
            v22 = (unsigned int *)v3[3];
            v15 = 4;
            if( v22 )
              v15 = *v22;
            SubKeyByName = ((__int64(__fastcall *)(ULONG_PTR *, _QWORD, int *))qword_140D5B768)(
                             &CmControlHive,
                             ValueByName,
                             v33);
            v23 = SubKeyByName;
            if( !SubKeyByName )
              return SubKeyByName;
            v24 = (_HHIVE *)*(unsigned int *)(SubKeyByName + 4);
            v25 = (_DWORD)v24 + 0x80000000;
            if( (unsigned int)v24 < 0x80000000 )
              v25 = *(_DWORD *)(SubKeyByName + 4);
            if( v15 >= v25 )
              v15 = v25;
            if( v15 && !CmpGetBootValueData(v24, (_CM_KEY_VALUE *)SubKeyByName, v3[2], v15) )
              return((__int64(__fastcall *)(ULONG_PTR *, int *))qword_140D5B770)(&CmControlHive, v33);
            v26 = v3[4];
            if( v26 )
              *(_DWORD *)v26 = *(_DWORD *)(v23 + 12);
            ((void(__fastcall *)(ULONG_PTR *, int *))qword_140D5B770)(&CmControlHive, v33);
          }
        }
        v20 = (unsigned int *)v3[3];
        if( v20 )
          *v20 = v15;
      }
      v3 += 6;
    }
    while( *v3 );
  }
  if( *(_DWORD *)CmDefaultLanguageIdType == 1 )
  {
    PsDefaultSystemLocaleId = CmpConvertLangId(&CmDefaultLanguageId, (unsigned int)CmDefaultLanguageIdLength);
  }
  else if( !a3 )
  {
    PsDefaultSystemLocaleId = 1033;
  }
  if( CmInstallUILanguageIdType == 1 )
    PsInstallUILanguageId = CmpConvertLangId(&CmInstallUILanguageId, (unsigned int)CmInstallUILanguageIdLength);
  if( !a3 )
  {
    v21 = CmSelectQualifiedInstallLanguage(v14, v13, &LCIDPickedUp, (unsigned __int16)PsInstallUILanguageId);
    if( v21 )
    {
      if( !psMUITest )
        KeBugCheckEx(0x12Au, 1ui64, v21, 0i64, 0i64);
      PsInstallUILanguageId = PsDefaultSystemLocaleId;
    }
    else if( (unsigned __int16)PsInstallUILanguageId != (_DWORD)LCIDPickedUp )
    {
      PsInstallUILanguageId = LCIDPickedUp;
      CmInstallUILanguageFallbackToOOBm = 1;
    }
  }
  SubKeyByName = (unsigned int)PsDefaultSystemLocaleId;
  PsDefaultThreadLocaleId = PsDefaultSystemLocaleId;
  if( !PsMachineUILanguageId || a3 == 1 )
  {
    SubKeyByName = (unsigned __int16)PsInstallUILanguageId;
    PsMachineUILanguageId = PsInstallUILanguageId;
  }
  return SubKeyByName;
}

Referenced by: