RtlpQueryRegistryValues

UINT8 __stdcall RtlpQueryRegistryValues(_KTRAP_FRAME *TrapFrame, _KEXCEPTION_FRAME *ExceptionFrame){
  _RTL_QUERY_REGISTRY_TABLE *v2; 
  VOID *v3; 
  VOID *v4; 
  _RTL_QUERY_REGISTRY_TABLE *v5; 
  unsigned int v6; 
  int v8; 
  NTSTATUS RegistryHandle; 
  int v10; 
  _KEXCEPTION_FRAME *v11; 
  INT64 *v12; 
  char *v13; 
  INT64 *v14; 
  char *v15; 
  int v16; 
  int v17; 
  unsigned int Flags; 
  const wchar_t *Name; 
  int v20; 
  NTSTATUS v21; 
  UINT8 v22; 
  int v23; 
  int v24; 
  char *v25; 
  int v26; 
  INT64 v27; 
  UINT64 Length; 
  UINT64 *ResultLength; 
  INT64 ValidateKeyTrust; 
  INT64 v32; 
  UINT64 PKeyValueInfoLength; 
  VOID *KeyHandle; 
  VOID *Key; 
  UINT64 PAllocLength; 
  _UNICODE_STRING ValueName; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Context; 
  INT64 pStatus; 
  UINT8 v42; 

  Context = v3;
  v4 = v3;
  v5 = v2;
  v6 = 0;
  Key = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  LODWORD(PKeyValueInfoLength) = 0;
  v8 = (int)TrapFrame;
  DestinationString = 0i64;
  ValueName = 0i64;
  RegistryHandle = RtlpGetRegistryHandle((UINT64)TrapFrame, (const WCHAR *)ExceptionFrame, 0, &Key);
  LODWORD(pStatus) = RegistryHandle;
  if( RegistryHandle < 0 )
    return RegistryHandle;
  v10 = v8 & 0x40000000;
  if( v10 )
    v11 = 0i64;
  else
    v11 = ExceptionFrame;
  RtlInitUnicodeString(&DestinationString, (PCWSTR)v11);
  PAllocLength = 136i64;
  v13 = (char *)RtlpAllocDeallocQueryBuffer(&PAllocLength, 0i64, v12, (INT64)&pStatus);
  v15 = v13;
  if( v13 )
  {
    LOBYTE(v16) = pStatus;
    v17 = 134;
    *((_DWORD *)v13 + 2) = 0;
    KeyHandle = Key;
LABEL_6:
    if( !v5->QueryRoutine && (v5->Flags & 0x21) == 0 )
    {
LABEL_8:
      if( Key && !v10 )
        ZwClose((_HANDLE)Key);
      if( KeyHandle && KeyHandle != Key )
        ZwClose((_HANDLE)KeyHandle);
      RtlpAllocDeallocQueryBuffer(0i64, v15, v14, 0i64);
      LOBYTE(RegistryHandle) = v16;
      return RegistryHandle;
    }
    Flags = v5->Flags;
    if( (Flags & 0x20) != 0 && (!v5->Name || (Flags & 1) != 0 || v5->QueryRoutine) )
    {
LABEL_76:
      LOBYTE(v16) = 13;
      goto LABEL_8;
    }
    if( (Flags & 3) != 0 && KeyHandle != Key )
    {
      ZwClose((_HANDLE)KeyHandle);
      KeyHandle = Key;
      Flags = v5->Flags;
    }
    Name = v5->Name;
    if( (Flags & 1) != 0 )
    {
      if( !Name )
        goto LABEL_76;
      RtlInitUnicodeString(&DestinationString, Name);
      ObjectAttributes.RootDirectory = Key;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v16 = ZwOpenKey(
              &KeyHandle,
              0x2000000ui64,
              &ObjectAttributes,
              v27,
              Length,
              (INT64)ResultLength,
              ValidateKeyTrust,
              v32);
      if( v16 < 0 )
        goto LABEL_8;
      if( !v5->QueryRoutine )
        goto LABEL_31;
    }
    else
    {
      if( Name )
      {
        RtlInitUnicodeString(&ValueName, Name);
        while( 1 )
        {
          v20 = v6++;
          if( v20 > 4 )
          {
            DbgPrint("RtlpQueryRegistryValues: Miscomputed buffer size at line %d\n", 1276i64);
            goto LABEL_8;
          }
          LODWORD(Length) = v17;
          v16 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValueFullInformation, v15, Length, &PKeyValueInfoLength);
          if( v16 == -2147483643 )
            v16 = -1073741789;
          LODWORD(pStatus) = v16;
          if( v16 < 0 )
          {
            if( v16 == -1073741772 )
            {
              v22 = v42;
              *((_DWORD *)v15 + 1) = 0;
              *((_DWORD *)v15 + 3) = 0;
              LODWORD(PKeyValueInfoLength) = v17;
              v16 = RtlpCallQueryRegistryRoutine(
                      KeyHandle,
                      v5,
                      (_KEY_VALUE_FULL_INFORMATION *)v15,
                      &PKeyValueInfoLength,
                      v4,
                      ResultLength,
                      v22);
              LODWORD(pStatus) = v16;
            }
            if( v16 != -1073741789 )
              goto LABEL_36;
          }
          else
          {
            if( *((_DWORD *)v15 + 1) == 7 )
            {
              *(_WORD *)&v15[(unsigned int)PKeyValueInfoLength] = 0;
              *((_DWORD *)v15 + 3) += 2;
            }
            LODWORD(PKeyValueInfoLength) = v17;
            v21 = RtlpCallQueryRegistryRoutine(
                    KeyHandle,
                    v5,
                    (_KEY_VALUE_FULL_INFORMATION *)v15,
                    &PKeyValueInfoLength,
                    v4,
                    ResultLength,
                    v42);
            LODWORD(pStatus) = v21;
            v16 = v21;
            if( v21 != -1073741789 )
            {
              v6 = 0;
              if( v21 < 0 )
                goto LABEL_8;
              if( (v5->Flags & 0x40) != 0 )
                ZwDeleteValueKey(KeyHandle, &ValueName, (_OBJECT_TYPE *)v14);
LABEL_31:
              if( v16 >= 0 )
              {
                ++v5;
                goto LABEL_6;
              }
              goto LABEL_8;
            }
          }
          v16 = PKeyValueInfoLength + 10;
          PAllocLength = (unsigned int)PKeyValueInfoLength + 10i64;
          v15 = (char *)RtlpAllocDeallocQueryBuffer(&PAllocLength, v15, v14, (INT64)&pStatus);
          if( !v15 )
          {
            LOBYTE(v16) = pStatus;
            goto LABEL_8;
          }
          v17 = v16 - 2;
          *((_DWORD *)v15 + 2) = 0;
          LOBYTE(v16) = pStatus;
        }
      }
      if( (Flags & 8) != 0 )
      {
        ResultLength = (UINT64 *)v5->EntryContext;
        Length = (UINT64)v4;
        v16 = ((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD, _QWORD))v5->QueryRoutine)(0i64, 0i64, 0i64, 0i64);
        goto LABEL_31;
      }
    }
    v23 = 0;
    while( 1 )
    {
      LODWORD(Length) = v17;
      v16 = ZwEnumerateValueKey(KeyHandle, v6, KeyValueFullInformation, v15, Length, &PKeyValueInfoLength);
      if( v16 == -2147483643 )
        v16 = -1073741789;
      LODWORD(pStatus) = v16;
      if( v16 == -2147483622 )
      {
        if( v6 || (v5->Flags & 4) == 0 )
        {
          v6 = 0;
          v16 = 0;
        }
        else
        {
          v16 = -1073741772;
          v6 = 0;
        }
        v4 = Context;
        goto LABEL_31;
      }
      if( v16 >= 0 )
      {
        LODWORD(PKeyValueInfoLength) = v17;
        v16 = RtlpCallQueryRegistryRoutine(
                KeyHandle,
                v5,
                (_KEY_VALUE_FULL_INFORMATION *)v15,
                &PKeyValueInfoLength,
                Context,
                ResultLength,
                v42);
        LODWORD(pStatus) = v16;
      }
      if( v16 == -1073741789 )
      {
        v24 = PKeyValueInfoLength + 10;
        PAllocLength = (unsigned int)PKeyValueInfoLength + 10i64;
        v25 = (char *)RtlpAllocDeallocQueryBuffer(&PAllocLength, v15, v14, (INT64)&pStatus);
        v15 = v25;
        if( !v25 )
          goto LABEL_75;
        *((_DWORD *)v25 + 2) = 0;
        v17 = v24 - 2;
        v26 = v23;
        --v6;
        ++v23;
        if( v26 > 4 )
        {
          DbgPrint("RtlpQueryRegistryValues: Miscomputed buffer size at line %d\n", 1457i64);
LABEL_75:
          v16 = pStatus;
          v4 = Context;
LABEL_36:
          v6 = 0;
          goto LABEL_31;
        }
      }
      else
      {
        if( v16 < 0 )
          goto LABEL_8;
        v23 = 0;
        if( (v5->Flags & 0x40) != 0 )
        {
          ValueName.Buffer = (wchar_t *)(v15 + 20);
          ValueName.Length = *((_WORD *)v15 + 8);
          ValueName.MaximumLength = *((_WORD *)v15 + 8);
          if( ZwDeleteValueKey(KeyHandle, &ValueName, (_OBJECT_TYPE *)v14) >= 0 )
            --v6;
        }
      }
      ++v6;
    }
  }
  if( !v10 )
    ZwClose((_HANDLE)Key);
  LOBYTE(RegistryHandle) = pStatus;
  return RegistryHandle;
}

Referenced by: