RtlpMuiRegLoadInstalledFromKey
NTSTATUS __fastcall RtlpMuiRegLoadInstalledFromKey(_MUIREGISTRYINFO *RegInfo, const WCHAR *a2, WCHAR a3){
unsigned int *v3;
unsigned int v5;
UINT64 v6;
int v7;
unsigned __int64 v8;
UINT64 v9;
VOID *v10;
__int16 v11;
unsigned int v12;
char v13;
UINT64 v14;
UINT64 v15;
INT64 Length;
UINT64 Lengtha;
UINT64 *ResultLength;
UINT64 *ResultLengtha;
INT64 v21;
INT64 v22;
INT64 v23;
INT64 v24;
int KeyValue;
v3 = (unsigned int *)((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64);
v3[6] = 0;
*((_QWORD *)v3 + 1) = 0i64;
*v3 = 0;
v5 = 0;
*((_WORD *)v3 + 2) = -1;
*(_OWORD *)(v3 + 10) = 0i64;
*((_QWORD *)v3 + 2) = 0i64;
RtlInitUnicodeString((PUNICODE_STRING)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 40), a2);
if( LdrpOpenKey((_UNICODE_STRING *)(v3 + 10), 0i64, v6, (VOID **)v3 + 2, Length, (INT64)ResultLength, v21, v23) < 0 )
return 0;
do
{
LODWORD(Lengtha) = 512;
v7 = ZwEnumerateKey(
*(VOID **)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x10),
v5,
KeyBasicInformation,
v3 + 16,
Lengtha,
(UINT64 *)v3 + 3);
if( v7 < 0 )
{
if( v7 != -2147483622 )
goto LABEL_19;
}
else
{
v8 = *(unsigned int *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x4C);
if( v8 + 24 <= 0x200 )
{
*(_WORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 2 * (v8 >> 1) + 0x50) = 0;
RtlInitUnicodeString((PUNICODE_STRING)(v3 + 10), (PCWSTR)v3 + 40);
if( LdrpOpenKey(
(_UNICODE_STRING *)(v3 + 10),
*(VOID **)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x10),
v9,
(VOID **)v3 + 1,
Lengtha,
(INT64)ResultLengtha,
v22,
v24) >= 0 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v3 + 10), L"Type");
v10 = *(VOID **)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 8);
*(_DWORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x20) = 4;
*(_DWORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x1C) = 4;
if( LdrpQueryValueKey(
v10,
(_UNICODE_STRING *)(v3 + 10),
(UINT64 *)v3 + 4,
(VOID *)((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64),
(UINT64 *)(v3 + 7)) >= 0
&& ValidateRegistrLangType(*v3) >= 0 )
{
v12 = v11 & 0x419F;
*v3 = v12;
if( (v12 & 7) != 0 && (v12 & 7 & -(v12 & 7)) == (v12 & 7) )
{
if( (v12 & 0x180) == 0 || (v13 = v12, (v12 & 0x180 & -(v12 & 0x180)) != (v12 & 0x180)) )
{
v12 = v12 & 0xFFFFFE7F | 0x80;
*v3 = v12;
v13 = v12;
}
if( (v13 & 0x18) != 0
&& (v13 & 0x18 & -(v13 & 0x18)) == (v13 & 0x18)
&& ((v13 & 8) == 0 || (v13 & 4) != 0) )
{
RtlpMuiRegAddLanguageByName(
RegInfo,
*(PVOID *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 8),
(PWCHAR)v3 + 40,
v12);
}
}
}
}
}
}
v14 = *(_QWORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 8);
if( v14 )
{
NtClose(v14);
*(_QWORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 8) = 0i64;
}
++v5;
}
while( v7 != -2147483622 );
v7 = 0;
LABEL_19:
v15 = *(_QWORD *)(((unsigned __int64)&KeyValue & 0xFFFFFFFFFFFFFFE0ui64) + 0x10);
if( v15 )
NtClose(v15);
return v7;
}Referenced by:
RtlpMuiRegLoadInstalled