IopQueryRegistryKeySystemPath

NTSTATUS __stdcall IopQueryRegistryKeySystemPath(_HANDLE Handle, PUNICODE_STRING DestinationString){
  VOID *v3; 
  _UNICODE_STRING *Pool_1; 
  int appended; 
  unsigned __int16 Length; 
  unsigned int v7; 
  wchar_t *Buffer; 
  wchar_t *v9; 
  unsigned __int16 v10; 
  unsigned __int16 v11; 
  unsigned int v13; 
  _UNICODE_STRING DestinationStringa; 
  _UNICODE_STRING String1; 
  _UNICODE_STRING String2; 
  _UNICODE_STRING v17; 
  _UNICODE_STRING SourceString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 ReturnLength; 
  VOID *LinkHandle; 

  *(_QWORD *)&String2.Length = 917516i64;
  *(_QWORD *)&SourceString.Length = 1703960i64;
  *(_QWORD *)&v17.Length = 1966108i64;
  String2.Buffer = (wchar_t *)L"System";
  v3 = *(VOID **)&Handle;
  SourceString.Buffer = L"\\SystemRoot\\";
  LinkHandle = 0i64;
  v17.Buffer = L"\\DriverStores\\";
  LODWORD(ReturnLength) = 0;
  String1 = 0i64;
  DestinationStringa = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  RtlInitUnicodeString(DestinationString, 0i64);
  RtlInitUnicodeString(&DestinationStringa, 0i64);
  RtlInitUnicodeString(&String1, 0i64);
  Pool_1 = (_UNICODE_STRING *)IopVerifierExAllocatePool_1(1ui64, 0x1000ui64);
  if( !Pool_1 )
  {
    appended = -1073741670;
    goto LABEL_19;
  }
  appended = NtQueryObject(v3, ObjectNameInformation, Pool_1, 0x1000ui64, &ReturnLength);
  if( appended >= 0 )
  {
    Length = Pool_1->Length;
    v7 = CmRegistryMachineName.Length + 2;
    if( Pool_1->Length < (unsigned __int16)(CmRegistryMachineName.Length + 2)
      || !(unsigned __int8)RtlPrefixUnicodeString(&CmRegistryMachineName, Pool_1, 1u)
      || (Buffer = Pool_1->Buffer, v9 = &Buffer[(unsigned __int64)v7 >> 1], *(v9 - 1) != 92) )
    {
      appended = -1073741595;
      goto LABEL_18;
    }
    v10 = Length - v7;
    String1.Buffer = &Buffer[(unsigned __int64)v7 >> 1];
    String1.MaximumLength = v10;
    v11 = 0;
    String1.Length = 0;
    if( v10 )
    {
      do
      {
        if( v9[(unsigned __int64)v11 >> 1] == 92 )
          break;
        v11 += 2;
      }
      while( v11 < v10 );
      String1.Length = v11;
    }
    if( !(unsigned __int8)RtlEqualUnicodeString(&String1, &String2, 1u) )
    {
      v13 = v11 + 32;
      if( v13 > 0xFFFF )
      {
        appended = -2147483643;
        goto LABEL_18;
      }
      DestinationStringa.MaximumLength = v11 + 32;
      DestinationStringa.Length = 0;
      DestinationStringa.Buffer = (wchar_t *)IopVerifierExAllocatePool_1(1ui64, (unsigned __int16)v13);
      if( !DestinationStringa.Buffer )
        goto LABEL_20;
      RtlCopyUnicodeString(&DestinationStringa, &v17);
      appended = RtlAppendUnicodeStringToString(&DestinationStringa, &String1);
      if( appended < 0 )
        goto LABEL_18;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationStringa;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      appended = ZwOpenSymbolicLinkObject(&LinkHandle, 1, &ObjectAttributes);
      if( appended < 0 )
      {
        DestinationStringa.Length = 0;
      }
      else
      {
        ZwClose((_HANDLE)LinkHandle);
        DestinationStringa.Buffer[(unsigned __int64)DestinationStringa.Length >> 1] = 92;
        DestinationStringa.Length += 2;
        DestinationStringa.Buffer[(unsigned __int64)DestinationStringa.Length >> 1] = 0;
      }
    }
    if( DestinationStringa.Length )
    {
LABEL_17:
      *DestinationString = DestinationStringa;
      RtlInitUnicodeString(&DestinationStringa, 0i64);
      goto LABEL_18;
    }
    if( DestinationStringa.MaximumLength >= 0x1Au )
      goto LABEL_16;
    if( DestinationStringa.Buffer )
      ExFreePoolWithTag(DestinationStringa.Buffer, 0);
    DestinationStringa.MaximumLength = 26;
    DestinationStringa.Buffer = (wchar_t *)IopVerifierExAllocatePool_1(1ui64, 0x1Aui64);
    if( DestinationStringa.Buffer )
    {
LABEL_16:
      RtlCopyUnicodeString(&DestinationStringa, &SourceString);
      goto LABEL_17;
    }
LABEL_20:
    appended = -1073741670;
  }
LABEL_18:
  ExFreePoolWithTag(Pool_1, 0);
LABEL_19:
  RtlFreeAnsiString(&DestinationStringa);
  return appended;
}

Referenced by: