VrpPostQueryKey

INT64 __fastcall VrpPostQueryKey(INT64 a1){
  __int64 v2; 
  __int64 v3; 
  INT8 PreviousMode; 
  errno_t v5; 
  __int64 *v6; 
  INT8 v7; 
  unsigned int v8; 
  __int64 v9; 
  int v11; 
  WCHAR *v12; 
  NTSTATUS v13; 
  NTSTATUS v14; 
  __int64 *v15; 
  bool v16; 
  __int64 *v17; 
  _UNICODE_STRING *KeyName; 
  _UNICODE_STRING *KeyNamea; 
  WCHAR *KeyFlags; 
  WCHAR *KeyFlagsa; 
  UINT64 KeyFlagsb; 
  errno_t updated; 
  int v24; 
  PVOID BufferUsed; 
  PVOID SuspectBuffer; 
  INT64 v27; 
  GUID ActivityId; 
  struct _EVENT_DATA_DESCRIPTOR v29[2]; 
  __int64 *v30; 
  __int64 v31; 
  __int64 *v32; 
  __int64 v33; 
  int *p_updated; 
  __int64 v35[3]; 
  v27 = a1;
  ActivityId = 0i64;
  EtwActivityIdControl(3u, &ActivityId);
  v2 = *(_QWORD *)(a1 + 40);
  v3 = *(_QWORD *)(a1 + 16);
  BufferUsed = 0i64;
  PreviousMode = ExGetPreviousMode();
  v5 = *(_DWORD *)(a1 + 8);
  v6 = &EmptyUnicodeString;
  SuspectBuffer = 0i64;
  v7 = PreviousMode;
  if( v5 < 0 && v5 != -1073741789 && v5 != -2147483643 )
    goto LABEL_4;
  v8 = *(_DWORD *)(v3 + 8);
  if( v8 > 8 )
    goto LABEL_4;
  v9 = 283i64;
  if( !_bittest((const int *)&v9, v8) )
    goto LABEL_4;
  if( (unsigned int)CallbackContext > 5 )
  {
    v15 = (__int64 *)(v2 + 16);
    v24 = *(_DWORD *)(v3 + 8);
    v31 = 4i64;
    v30 = (__int64 *)&v24;
    if( !*(_QWORD *)(v2 + 24) )
      v15 = &EmptyUnicodeString;
    v33 = 2i64;
    v32 = v35;
    p_updated = (int *)v15[1];
    v35[0] = *(unsigned __int16 *)v15;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&CallbackContext,
      (unsigned __int8 *)&word_14002345E,
      &ActivityId,
      0i64,
      5u,
      v29);
  }
  if( (*(_DWORD *)(v2 + 36) & 0x20000000) == 0 )
  {
    v11 = *(_DWORD *)(v3 + 8);
    if( v11 != 3 && v11 != 8 )
      goto LABEL_4;
  }
  LOBYTE(v9) = v7;
  v5 = VrpProcessBufferParameter(
         (PWCHAR)v9,
         *(_QWORD *)(v3 + 16),
         (PWCHAR)*(unsigned int *)(v3 + 24),
         (PWCHAR)&BufferUsed,
         &KeyName->Length,
         KeyFlags);
  if( v5 >= 0 )
  {
    v5 = VrpOutputBufferParameter(v7, BufferUsed, *(unsigned int *)(v3 + 24), (PVOID *)(v3 + 16));
    if( v5 >= 0 )
    {
      LOBYTE(v12) = v7;
      v5 = VrpProcessBufferParameter(
             v12,
             *(_QWORD *)(v3 + 32),
             (PWCHAR)4,
             (PWCHAR)&SuspectBuffer,
             &KeyNamea->Length,
             KeyFlagsa);
      if( v5 >= 0 )
      {
        v5 = VrpOutputBufferParameter(v7, SuspectBuffer, 4ui64, (PVOID *)(v3 + 32));
        if( v5 >= 0 )
        {
          LODWORD(KeyFlagsb) = *(_DWORD *)(v2 + 36);
          updated = VrpUpdateKeyInformation(
                      (_KEY_INFORMATION_CLASS)*(_DWORD *)(v3 + 8),
                      BufferUsed,
                      *(unsigned int *)(v3 + 24),
                      (UINT64 *)SuspectBuffer,
                      (_UNICODE_STRING *)(v2 + 16),
                      KeyFlagsb);
          v5 = updated;
          if( updated >= 0 || updated == -2147483643 || updated == -1073741789 )
          {
            v13 = VrpOutputBufferParameter(v7, *(PVOID *)(v3 + 16), *(unsigned int *)(v3 + 24), &BufferUsed);
            if( v13 < 0 )
            {
              v5 = v13;
            }
            else
            {
              v14 = VrpOutputBufferParameter(v7, *(PVOID *)(v3 + 32), 4ui64, &SuspectBuffer);
              if( v14 < 0 )
              {
                v5 = v14;
              }
              else
              {
                *(_DWORD *)(v27 + 24) = updated;
                v5 = -1073740541;
                if( (unsigned int)CallbackContext <= 5 )
                  goto LABEL_5;
                v16 = *(_QWORD *)(v2 + 24) == 0i64;
                v17 = &EmptyUnicodeString;
                v31 = 2i64;
                if( !v16 )
                  v17 = (__int64 *)(v2 + 16);
                v35[0] = 4i64;
                v30 = &v33;
                v35[2] = 4i64;
                v32 = (__int64 *)v17[1];
                v33 = *(unsigned __int16 *)v17;
                v24 = *(_DWORD *)(v3 + 8);
                p_updated = &v24;
                v35[1] = (__int64)&updated;
                tlgWriteTransfer_EtwWriteTransfer(
                  (__int64)&CallbackContext,
                  (unsigned __int8 *)word_14002351A,
                  &ActivityId,
                  0i64,
                  6u,
                  v29);
              }
            }
          }
LABEL_4:
          if( v5 >= 0 )
            goto LABEL_5;
        }
      }
    }
  }
  if( v5 != -1073740541 && (unsigned int)CallbackContext > 2 )
  {
    if( *(_QWORD *)(v2 + 24) )
      v6 = (__int64 *)(v2 + 16);
    v31 = 2i64;
    v30 = &v33;
    v32 = (__int64 *)v6[1];
    v33 = *(unsigned __int16 *)v6;
    p_updated = &updated;
    updated = v5;
    v35[0] = 4i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&CallbackContext,
      (unsigned __int8 *)&dword_14002349C,
      &ActivityId,
      0i64,
      5u,
      v29);
  }
LABEL_5:
  VrpCleanupBufferParameter(v7, &BufferUsed);
  VrpCleanupBufferParameter(v7, &SuspectBuffer);
  return(unsigned int)v5;
}

Referenced by: