RtlpProcessIFEOKeyFilter

NTSTATUS __stdcall RtlpProcessIFEOKeyFilter(PVOID *KeyHandle, UNICODE_STRING *ImagePathName){
  UNICODE_STRING *v2; 
  NTSTATUS v3; 
  PVOID *v4; 
  void *v5; 
  UNICODE_STRING *v6; 
  char *v7; 
  NTSTATUS result; 
  unsigned int v9; 
  bool v10; 
  char *v11; 
  unsigned int v12; 
  NTSTATUS inited; 
  ULONG v14; 
  NTSTATUS v15; 
  VOID *PoolWithQuotaTag; 
  NTSTATUS v17; 
  UINT64 Length; 
  UINT64 ResultLength; 
  void *KeyHandlea; 
  int v21; 
  struct _UNICODE_STRING DestinationString; 
  UNICODE_STRING String2; 
  unsigned int v24; 
  char *v25; 
  UNICODE_STRING v26; 
  PVOID *v27; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v30; 
  int v31; 
  int v32; 
  v27 = KeyHandle;
  v3 = 0;
  v4 = KeyHandle;
  ResultLength = 0x22000000000i64;
  KeyHandlea = 0i64;
  DestinationString = 0i64;
  v5 = 0i64;
  v6 = v2;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v7 = KeyValueInformation;
  v26 = 0i64;
  result = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"UseFilter");
  if( result < 0 )
    return result;
  result = ZwQueryValueKey(
             *v4,
             &DestinationString,
             KeyValuePartialInformation,
             KeyValueInformation,
             0x220u,
             (PULONG)&ResultLength);
  if( result < 0 )
  {
    if( result == -1073741772 || result == -1073741789 || result == -2147483643 )
      return v3;
    return result;
  }
  if( v30 != 4 || v31 != 4 || !v32 )
    return 0;
  v9 = 1600;
  v10 = *((_BYTE *)KeGetCurrentThread() + 562) == 1;
  String2 = *v6;
  if( !v10 )
    v9 = 576;
  v24 = v9;
  result = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"\\??\\");
  if( result >= 0 )
  {
    if( (unsigned __int8)RtlPrefixUnicodeString(&DestinationString, (INT64 *)&String2) )
    {
      String2.Length -= 8;
      String2.MaximumLength -= 8;
      String2.Buffer += 4;
    }
    v11 = KeyValueInformation;
    v21 = 0;
    v25 = KeyValueInformation;
    v12 = 0;
    while( 1 )
    {
      LODWORD(Length) = HIDWORD(ResultLength);
      inited = ZwEnumerateKey(*v4, v12, KeyBasicInformation, v11, Length, &ResultLength);
      if( inited >= 0 )
      {
        DestinationString.Length = *((_WORD *)v25 + 6);
        DestinationString.MaximumLength = *((_WORD *)v25 + 6);
        DestinationString.Buffer = (wchar_t *)(v25 + 16);
        ObjectAttributes.RootDirectory = *v4;
        ObjectAttributes.Attributes = v24;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Length = 48;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        inited = ZwOpenKey(&KeyHandlea, 9u, &ObjectAttributes);
        if( inited >= 0 )
        {
          inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"FilterFullPath");
          if( inited >= 0 )
          {
            v14 = HIDWORD(ResultLength);
            do
            {
              v15 = ZwQueryValueKey(
                      KeyHandlea,
                      &DestinationString,
                      KeyValuePartialInformation,
                      v7,
                      v14,
                      (PULONG)&ResultLength);
              inited = v15;
              if( v15 == -2147483643 || v15 == -1073741789 )
              {
                if( v5 )
                  ExFreePoolWithTag(v5, 0);
                PoolWithQuotaTag = ExAllocatePoolWithQuotaTag(
                                     (POOL_TYPE)520,
                                     (unsigned int)ResultLength,
                                     0x6B497452ui64);
                v5 = PoolWithQuotaTag;
                if( PoolWithQuotaTag )
                {
                  v14 = ResultLength;
                  v7 = (char *)PoolWithQuotaTag;
                  v25 = (char *)PoolWithQuotaTag;
                }
                else
                {
                  inited = -1073741801;
                }
              }
            }
            while( inited == -2147483643 || inited == -1073741789 );
            HIDWORD(ResultLength) = v14;
            v4 = v27;
            if( inited < 0 )
            {
              ZwClose(KeyHandlea);
              v17 = 0;
              if( inited != -1073741772 )
                v17 = inited;
              inited = v17;
              goto LABEL_39;
            }
            if( *((_DWORD *)v7 + 1) == 1 && *((_DWORD *)v7 + 2) <= 0xFFFEu )
            {
              v26.Length = *((_WORD *)v7 + 4) - 2;
              v26.MaximumLength = v26.Length;
              v26.Buffer = (wchar_t *)(v7 + 12);
              if( !(unsigned int)RtlCompareUnicodeString(&String2, &v26, 1u) )
              {
LABEL_40:
                if( v5 )
                  ExFreePoolWithTag(v5, 0);
                if( inited >= 0 )
                {
                  ZwClose(*v4);
                  *v4 = KeyHandlea;
                }
                if( inited != -2147483622 )
                  return inited;
                return v3;
              }
            }
          }
          ZwClose(KeyHandlea);
        }
      }
LABEL_39:
      v11 = v25;
      v12 = ++v21;
      if( inited < 0 )
        goto LABEL_40;
    }
  }
  return result;
}

Referenced by: