PspReadUserQuotaLimits

__int64 __fastcall PspReadUserQuotaLimits(PSID Sid, _DWORD *a2, unsigned int *a3){
  int v3; 
  HANDLE v6; 
  int v7; 
  NTSTATUS v9; 
  signed __int64 v10; 
  unsigned int v11; 
  unsigned int *v12; 
  unsigned int v13; 
  UINT64 CreateOptions; 
  HANDLE Handle; 
  void *KeyHandle; 
  ULONG ResultLength; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  _DWORD *v19; 
  struct _UNICODE_STRING UnicodeString; 
  __int128 KeyValueInformation; 
  int v22; 
  v3 = 0;
  v19 = a2;
  ResultLength = 0;
  KeyHandle = 0i64;
  KeyValueInformation = 0i64;
  v22 = 0;
  *(_OWORD *)&ObjectAttributes.Length = 0i64;
  *a2 = 1;
  v6 = (HANDLE)PspQuotaDatabaseKey;
  Handle = (HANDLE)PspQuotaDatabaseKey;
  memset(&ObjectAttributes.ObjectName, 0, 32);
  UnicodeString = 0i64;
  if( !PspQuotaDatabaseKey )
  {
    LODWORD(CreateOptions) = 0;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 704;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)PspQuotaKeyNames;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v9 = ZwCreateKey(&Handle, 9ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
    v10 = (signed __int64)Handle;
    if( v9 < 0 )
      v10 = 1i64;
    Handle = (HANDLE)v10;
    v6 = (HANDLE)_InterlockedCompareExchange64(&PspQuotaDatabaseKey, v10, 0i64);
    if( v6 )
    {
      if( Handle != (HANDLE)1 )
        ZwClose(Handle);
      Handle = v6;
    }
    else
    {
      v6 = Handle;
    }
  }
  if( v6 == (HANDLE)1 )
    return 0;
  v7 = RtlConvertSidToUnicodeString(&UnicodeString, Sid, 1u);
  if( v7 >= 0 )
  {
    ObjectAttributes.RootDirectory = Handle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &UnicodeString;
    ObjectAttributes.Attributes = 704;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes);
    RtlFreeAnsiString(&UnicodeString);
    if( v7 >= 0 )
    {
      v11 = 0;
      v12 = a3;
      do
      {
        v7 = ZwQueryValueKey(
               KeyHandle,
               (PUNICODE_STRING)&PspDefaultResourceNames[8 * v3],
               KeyValuePartialInformation,
               &KeyValueInformation,
               0x14u,
               &ResultLength);
        if( (int)(v7 + 0x80000000) >= 0 && v7 != -1073741772 )
        {
          ZwClose(KeyHandle);
          return(unsigned int)v7;
        }
        if( v7 == -1073741772 || *(_QWORD *)((char *)&KeyValueInformation + 4) != 0x400000004i64 )
        {
          v13 = *(unsigned int *)((char *)v12 + (char *)&PspDefaultResourceLimits - (char *)a3);
          ++v11;
        }
        else
        {
          v13 = HIDWORD(KeyValueInformation);
        }
        *v12 = v13;
        ++v3;
        ++v12;
      }
      while( v3 < 4 );
      ZwClose(KeyHandle);
      if( v11 < 4 )
      {
        v7 = PspSanitizeResourceLimits((UINT64 *)a3, 0i64);
        if( v7 < 0 )
          return(unsigned int)v7;
        *v19 = 0;
      }
      return 0;
    }
    if( v7 == -1073741772 )
      return 0;
  }
  return(unsigned int)v7;
}

Referenced by: