SdbResolveDatabaseEx

VOID __stdcall SdbResolveDatabaseEx(){
  UINT64 *v0; 
  __int64 v1; 
  _DWORD *v2; 
  NTSTATUS *v3; 
  _WORD *v4; 
  NTSTATUS *v5; 
  _DWORD *v6; 
  UINT64 *v7; 
  __int64 v8; 
  wchar_t *v9; 
  INT64 v10; 
  INT64 v11; 
  _QWORD *v12; 
  UINT64 v13; 
  VOID *v14; 
  INT64 v15; 
  INT8 *v16; 
  UINT64 v17; 
  int v18; 
  int v19; 
  INT64 v20; 
  __int64 v21; 
  NTSTATUS v22; 
  unsigned __int16 v23; 
  wchar_t *v24; 
  INT64 v25; 
  INT64 v26; 
  int v27; 
  int v28; 
  int v29; 
  __int64 v30; 
  wchar_t *Buffer; 
  INT64 v32; 
  INT64 v33; 
  UINT64 v34; 
  VOID *KeyHandle; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING UnicodeStringOut; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v39; 
  _WORD *v40; 
  int v41; 
  UINT64 ValueOut; 

  v39 = v1;
  v4 = v40;
  LODWORD(ValueOut) = 0;
  LODWORD(v34) = 0;
  KeyHandle = 0i64;
  v5 = v3;
  v6 = v2;
  v7 = v0;
  v8 = v1;
  v9 = 0i64;
  Destination = 0i64;
  UnicodeStringOut = 0i64;
  if( !v40 )
    return;
  *v40 = 0;
  v10 = (INT64)&off_140C0EFF0;
  v11 = 0i64;
  while( 1 )
  {
    v12 = *(_QWORD **)v10;
    v13 = **(_QWORD **)v10 - *v7;
    if( !v13 )
      v13 = v12[1] - v7[1];
    if( !v13 )
      break;
    v11 = (unsigned int)(v11 + 1);
    v10 += 24i64;
    if( (unsigned int)v11 >= 3 )
      goto LABEL_7;
  }
  v10 = *((unsigned int *)&off_140C0EFF0 + 6 * (int)v11 + 4);
  v18 = *((_DWORD *)&off_140C0EFF0 + 6 * (int)v11 + 2);
  v19 = *((_DWORD *)&off_140C0EFF0 + 6 * (int)v11 + 3);
  LODWORD(ValueOut) = v18;
  v41 = v19;
  if( !(_DWORD)v10 )
  {
LABEL_7:
    if( AslGuidToString_UStr(&UnicodeStringOut, (_GUID *)v7, v10) >= 0 )
    {
      v23 = UnicodeStringOut.Length + 184;
      v24 = (wchar_t *)AslAlloc(v14, (unsigned int)UnicodeStringOut.Length + 184, v15);
      v9 = v24;
      if( v24 )
      {
        Destination.MaximumLength = v23;
        Destination.Buffer = v24;
        Destination.Length = 0;
        RtlAppendUnicodeToString(
          &Destination,
          (WCHAR *)L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB");
        RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\");
        RtlAppendUnicodeStringToString(&Destination, &UnicodeStringOut);
        *(_QWORD *)&ObjectAttributes.Length = 48i64;
        ObjectAttributes.ObjectName = &Destination;
        *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
        ObjectAttributes.RootDirectory = 0i64;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( ZwOpenKey(&KeyHandle, 0x80000100ui64, &ObjectAttributes, v25, v32, v33, v34, (INT64)KeyHandle) >= 0 )
        {
          if( v6 )
          {
            AslRegistryGetUInt32_UStr(&ValueOut, KeyHandle, (_UNICODE_STRING *)&g_ustrDatabaseType);
            if( v27 < 0 )
            {
              AslLogCallPrintf(
                1ui64,
                (INT8 *)"SdbResolveDatabaseEx",
                0x805ui64,
                (INT8 *)"Failed to get database type [%x]");
              *v6 = 0;
              goto LABEL_38;
            }
            *v6 = ValueOut & 0x7FFFFFFF;
          }
          if( v5 )
          {
            AslRegistryGetUInt32_UStr(&v34, KeyHandle, (_UNICODE_STRING *)&g_ustrRuntimePlatform);
            if( v28 < 0 )
            {
              AslLogCallPrintf(
                1ui64,
                (INT8 *)"SdbResolveDatabaseEx",
                0x815ui64,
                (INT8 *)"Failed to get runtime platform [%x]");
              *v5 = 0;
              goto LABEL_38;
            }
            *v5 = v34;
          }
          LOBYTE(v29) = SdbGetPathCustomSdb(v4, v26, v7, v39 + 576);
          if( v29 )
          {
            v30 = -1i64;
            do
              ++v30;
            while( v4[v30] );
          }
          else
          {
            AslLogCallPrintf(
              1ui64,
              (INT8 *)"SdbResolveDatabaseEx",
              0x81Eui64,
              (INT8 *)"SdbGetPathCustomSdb failed to get the database path.");
          }
          goto LABEL_38;
        }
        AslLogCallPrintf(1ui64, (INT8 *)"SdbResolveDatabaseEx", 0x7F9ui64, (INT8 *)"Failed to open Key \"%ws\" [%x]");
LABEL_38:
        if( KeyHandle )
          ZwClose((_HANDLE)KeyHandle);
        if( v9 )
          ExFreePoolWithTag(v9, 0x74705041u);
        Buffer = UnicodeStringOut.Buffer;
        if( UnicodeStringOut.Buffer )
        {
          memset(UnicodeStringOut.Buffer, 66i64, UnicodeStringOut.MaximumLength);
          ExFreePoolWithTag(Buffer, 0x74705041u);
        }
        return;
      }
      v16 = "Failed to allocate %ld bytes for key path";
      v17 = 2025i64;
    }
    else
    {
      v16 = (INT8 *)"Failed to convert guid to string [%x]";
      v17 = 2004i64;
    }
    AslLogCallPrintf(1ui64, (INT8 *)"SdbResolveDatabaseEx", v17, v16);
    goto LABEL_38;
  }
  if( SdbpGetSystemSdbFilePath(v4, v11, v10, (INT64)v12, 0i64, v8 + 576) < 0 )
  {
    AslLogCallPrintf(1ui64, (INT8 *)"SdbResolveDatabaseEx", 0x7BDui64, (INT8 *)"SdbGetPathSystemSdb failed.");
  }
  else
  {
    v21 = -1i64;
    do
      ++v21;
    while( v4[v21] );
  }
  if( v6 )
    *v6 = v18;
  if( v5 )
  {
    v22 = SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(v20);
    *v5 = v22;
    if( v41 )
      *v5 = v22 & 0x1B;
  }
}

Referenced by: