SysCtxRegOpenCurrentUserKey

NTSTATUS __fastcall SysCtxRegOpenCurrentUserKey(
        HSYSCTX *hSysCtx,
        ULONG RegOptions,
        _ACCESS_MASK DesiredAccess,
        VOID **phkResult,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        INT64 _168){
  VOID **v12; 
  NTSTATUS InformationToken; 
  void *v14; 
  _DWORD *v15; 
  unsigned __int16 v17; 
  VOID **PoolWithTag; 
  __int64 v19; 
  UINT16 pusResult[2]; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  int TokenInformation; 
  UINT64 ReturnLength; 
  VOID *Handle; 
  UINT64 v25; 
  _UNICODE_STRING Destination; 
  VOID *v27; 
  _UNICODE_STRING UnicodeString; 
  char Sid[16]; 
  void *Sid2[11]; 

  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  Handle = 0i64;
  TokenInformation = 0;
  LODWORD(v25) = 0;
  LODWORD(ReturnLength) = 0;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  v27 = 0i64;
  *(_DWORD *)(&Destination.MaximumLength + 1) = 0;
  pusResult[0] = 0;
  v12 = 0i64;
  UnicodeString = 0i64;
  InformationToken = ZwOpenThreadTokenEx(0xFFFFFFFFFFFFFFFEui64, 8ui64, 0, 512i64, (UINT64)&Handle);
  if( InformationToken == -1073741700 )
    InformationToken = ZwOpenProcessTokenEx(0xFFFFFFFFFFFFFFFFui64, 8i64, 512i64, (UINT64)&Handle);
  if( InformationToken >= 0 )
  {
    InformationToken = ZwQueryInformationToken(
                         (UINT64)Handle,
                         8i64,
                         (UINT64)&TokenInformation,
                         4ui64,
                         (UINT64)&ReturnLength);
    if( InformationToken >= 0 )
    {
      if( TokenInformation == 2 )
      {
        InformationToken = ZwQueryInformationToken((UINT64)Handle, 9i64, (UINT64)&v25, 4ui64, (UINT64)&ReturnLength);
        if( InformationToken < 0 )
          goto LABEL_11;
        if( (int)v25 < 2 )
        {
          InformationToken = -1073741790;
          goto LABEL_11;
        }
      }
      else if( TokenInformation != 1 )
      {
LABEL_10:
        InformationToken = -1073741637;
        goto LABEL_11;
      }
      InformationToken = ZwQueryInformationToken((UINT64)Handle, 1i64, (UINT64)Sid2, 0x54ui64, (UINT64)&ReturnLength);
      if( InformationToken >= 0 )
      {
        v14 = Sid2[0];
        InformationToken = RtlInitializeSid(Sid, &IdentifierAuthority, 1u);
        if( InformationToken >= 0 )
        {
          LODWORD(v15) = RtlSubAuthoritySid((INT64)Sid, 0i64);
          *v15 = 18;
          if( RtlEqualSid(Sid, v14) )
            goto LABEL_10;
          InformationToken = RtlConvertSidToUnicodeString(&UnicodeString, v14, 1u);
          if( InformationToken >= 0 )
          {
            InformationToken = RtlUShortAdd(UnicodeString.Length, 0x1Eu, pusResult);
            if( InformationToken >= 0 )
            {
              InformationToken = RtlUShortAdd(pusResult[0], 2u, pusResult);
              if( InformationToken >= 0 )
              {
                v17 = pusResult[0];
                PoolWithTag = ExAllocatePoolWithTag(1ui64, pusResult[0], 1397771856i64);
                v12 = PoolWithTag;
                if( PoolWithTag )
                {
                  Destination.Length = 0;
                  Destination.MaximumLength = v17;
                  Destination.Buffer = (wchar_t *)PoolWithTag;
                  InformationToken = RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&stru_1400099A0);
                  if( InformationToken >= 0 )
                  {
                    InformationToken = RtlAppendUnicodeStringToString(&Destination, &UnicodeString);
                    if( InformationToken >= 0 )
                    {
                      InformationToken = SysCtxGetCachedContextBaseKey(hSysCtx, 3, &v27);
                      if( InformationToken >= 0 )
                        InformationToken = SysCtxRegOpenKey(
                                             v19,
                                             v27,
                                             (const WCHAR *)Destination.Buffer + 15,
                                             RegOptions,
                                             DesiredAccess,
                                             phkResult);
                    }
                  }
                }
                else
                {
                  InformationToken = -1073741801;
                }
              }
            }
          }
        }
      }
    }
  }
LABEL_11:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  RtlFreeAnsiString(&UnicodeString);
  if( v12 )
    ExFreePoolWithTag(v12, 0);
  return InformationToken;
}

Referenced by: