NtQueryOpenSubKeysEx

NTSTATUS __stdcall NtQueryOpenSubKeysEx(
        OBJECT_ATTRIBUTES *TargetKey,
        UINT64 BufferLength,
        VOID *Buffer,
        UINT64 *RequiredSize){
  UINT64 v6; 
  NTSTATUS v8; 
  INT8 v9; 
  __int64 v10; 
  INT64 v11; 
  UINT64 v12; 
  VOID *TransientPoolWithQuotaTag; 
  PADAPTER_OBJECT v14; 
  UINT8 *v15; 
  signed __int64 v16; 
  unsigned int v17; 
  INT64 v19; 
  char v20; 
  bool v21; 
  PADAPTER_OBJECT DmaAdapter; 
  size_t Size[2]; 
  __int128 v24; 
  __int128 v25; 
  int v26; 
  KAPC_STATE ApcState; 
  INT64 result[12]; 
  int v29; 
  _QWORD v30[9]; 
  INT64 v31[11]; 
  v6 = (unsigned int)BufferLength;
  v26 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  DmaAdapter = 0i64;
  memset((INT64)result, 0i64);
  v29 = -1;
  v30[1] = v30;
  v30[0] = v30;
  memset((INT64)v31, 0i64);
  *(_OWORD *)Size = 0i64;
  v24 = 0i64;
  v25 = 0i64;
  v20 = 0;
  v21 = CmpAcquireShutdownRundown();
  if( !v21 )
  {
    v8 = -1073741431;
    goto LABEL_22;
  }
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, v9) )
  {
    v8 = -1073741727;
    goto LABEL_22;
  }
  if( (unsigned int)v6 < 8 )
  {
    v8 = -1073741789;
    goto LABEL_22;
  }
  if( (v6 & 1) != 0 )
    goto LABEL_8;
  if( v9 == 1 )
  {
    v10 = (__int64)RequiredSize;
    if( (unsigned __int64)RequiredSize >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v10 = *(_DWORD *)v10;
    ProbeForWrite(Buffer, v6, 4ui64);
  }
  LOBYTE(v19) = v9;
  v8 = ObReferenceObjectByNameEx(
         (__int64)TargetKey,
         0i64,
         0x20019u,
         (__int64)CmKeyObjectType,
         v19,
         (__int64)result,
         &DmaAdapter);
  if( v8 >= 0 )
  {
    LODWORD(Size[0]) = v6;
    v12 = v6;
    TransientPoolWithQuotaTag = CmpAllocateTransientPoolWithQuotaTag(v11, v6, 0x31384D43ui64);
    Size[1] = (size_t)TransientPoolWithQuotaTag;
    if( TransientPoolWithQuotaTag )
    {
      memset((INT64)TransientPoolWithQuotaTag, 0i64);
      CmpLockRegistryExclusive();
      v20 = 1;
      v14 = DmaAdapter;
      v8 = CmpPerformKeyBodyDeletionCheck((__int64)DmaAdapter, 0i64);
      if( v8 >= 0 )
      {
        if( ((__int64)v14->DmaOperations->MapTransferEx & 0x40000) == 0 )
        {
LABEL_8:
          v8 = -1073741811;
          goto LABEL_22;
        }
        *(_DWORD *)Size[1] = 0;
        LODWORD(v24) = 8;
        *((_QWORD *)&v25 + 1) = v12 + Size[1];
        *(_QWORD *)&v25 = v14;
        *(_QWORD *)((char *)&v24 + 4) = 0x800000000i64;
        CmpAttachToRegistryProcess(&ApcState);
        CmpSearchForOpenSubKeys((INT64)v14->DmaOperations, 0i64, Size);
        CmpDetachFromRegistryProcess(&ApcState);
        v8 = DWORD1(v24);
        CmpUnlockRegistry();
        v20 = 0;
        *(_DWORD *)RequiredSize = v24;
        v15 = (UINT8 *)Size[1];
        *(_DWORD *)Buffer = *(_DWORD *)Size[1];
        if( v8 >= 0 )
        {
          v16 = v15 - (_BYTE *)Buffer;
          v17 = 0;
          if( *(_DWORD *)v15 )
          {
            do
            {
              *(_QWORD *)&v15[24 * ++v17] -= v16;
              v15 = (UINT8 *)Size[1];
            }
            while( v17 < *(_DWORD *)Size[1] );
          }
          memmove((UINT8 *)Buffer, v15, v12);
          v8 = 0;
        }
      }
    }
    else
    {
      v8 = -1073741670;
    }
  }
LABEL_22:
  if( v20 )
    CmpUnlockRegistry();
  CmpCleanupParseContext((__int64)result, 0);
  if( v21 )
    CmpReleaseShutdownRundown();
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( Size[1] )
    CmSiFreeMemory((PPRIVILEGE_SET)Size[1]);
  return v8;
}

Referenced by: