SepLoadNgenLocations

VOID __fastcall SepLoadNgenLocations(INT64 a1, INT64 a2){
  unsigned int v2; 
  unsigned int v3; 
  unsigned int v4; 
  unsigned int v5; 
  NTSTATUS v6; 
  unsigned int v7; 
  UINT8 *PoolWithTag; 
  _DWORD *v9; 
  signed __int64 v10; 
  __int16 v11; 
  unsigned int v12; 
  unsigned int v13; 
  __int16 v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned int v17; 
  UINT8 *v18; 
  unsigned int v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  PULONG ResultLength; 
  UINT64 v24; 
  void *KeyHandle; 
  ULONG Length; 
  UINT8 *dst; 
  INT64 v28; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  __int128 KeyInformation[2]; 
  __int128 v32; 
  v28 = a1;
  v2 = 0;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  KeyHandle = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  LODWORD(v24) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"tv";
  memset(KeyInformation, 0, sizeof(KeyInformation));
  v32 = 0i64;
  KeyValueInformation = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0
    && ZwQueryKey(KeyHandle, KeyFullInformation, KeyInformation, 0x30ui64, &v24) >= 0
    && (_DWORD)v32
    && (unsigned int)(DWORD1(v32) - 1) <= 0xFFFE )
  {
    v3 = 0;
    v4 = 0;
    v5 = 0;
    while( 1 )
    {
      LODWORD(ResultLength) = 16;
      v6 = ZwEnumerateValueKey(
             KeyHandle,
             v3,
             KeyValueBasicInformation,
             &KeyValueInformation,
             (UINT64)ResultLength,
             &v24);
      if( ((v6 + 0x80000000) & 0x80000000) == 0 && v6 != -2147483643 )
        break;
      if( DWORD1(KeyValueInformation) == 4 && DWORD2(KeyValueInformation) >= 2 )
      {
        v4 += DWORD2(KeyValueInformation) + 16;
        if( v4 < DWORD2(KeyValueInformation) + 16 )
          break;
        ++v5;
      }
      if( ++v3 >= (unsigned int)v32 )
      {
        if( v5 )
        {
          v7 = v4 + 8;
          if( v4 + 8 >= v4 )
          {
            Length = DWORD1(v32) + 16;
            PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(DWORD1(v32) + 16), 0x63734943ui64);
            if( PoolWithTag )
            {
              v9 = ExAllocatePoolWithTag(PagedPool, v7, 0x63734943ui64);
              v10 = (signed __int64)v9;
              if( v9 )
              {
                v11 = -1;
                v9[1] = 0xFFFF;
                v12 = 0;
                dst = (UINT8 *)&v9[4 * v5 + 2];
                v13 = v7 - (16 * v5 + 8);
                v14 = 0;
                if( (_DWORD)v32 )
                {
                  while( 1 )
                  {
                    LODWORD(ResultLength) = Length;
                    if( ZwEnumerateValueKey(
                           KeyHandle,
                           v12,
                           KeyValueBasicInformation,
                           PoolWithTag,
                           (UINT64)ResultLength,
                           &v24) < 0 )
                      break;
                    if( *((_DWORD *)PoolWithTag + 1) == 4 )
                    {
                      v15 = *((_DWORD *)PoolWithTag + 2);
                      if( v15 >= 2 )
                      {
                        v16 = *((_DWORD *)PoolWithTag + 2);
                        do
                        {
                          if( *(_WORD *)&PoolWithTag[2 * ((unsigned __int64)v15 >> 1) + 10] )
                            break;
                          *((_DWORD *)PoolWithTag + 2) = v15 - 2;
                          v15 -= 2;
                          v16 = v15;
                        }
                        while( v15 >= 2 );
                        if( v16 )
                        {
                          if( v16 > v13 || v2 >= v5 )
                            break;
                          v17 = *(unsigned __int16 *)(v10 + 4);
                          v18 = dst;
                          if( v17 >= v16 )
                            LOWORD(v17) = v16;
                          v19 = *(unsigned __int16 *)(v10 + 6);
                          *(_WORD *)(v10 + 4) = v17;
                          if( v19 <= *((_DWORD *)PoolWithTag + 2) )
                            LOWORD(v19) = *((_DWORD *)PoolWithTag + 2);
                          *(_WORD *)(v10 + 6) = v19;
                          v20 = 2i64 * v2;
                          *(_QWORD *)(v10 + 8 * v20 + 16) = v18;
                          *(_WORD *)(v10 + 8 * v20 + 8) = *((_WORD *)PoolWithTag + 4);
                          *(_WORD *)(v10 + 8 * v20 + 10) = *((_WORD *)PoolWithTag + 4);
                          memmove(v18, PoolWithTag + 12, *((unsigned int *)PoolWithTag + 2));
                          v21 = *((unsigned int *)PoolWithTag + 2);
                          dst += v21;
                          v13 -= v21;
                          ++v2;
                        }
                      }
                    }
                    if( ++v12 >= (unsigned int)v32 )
                    {
                      v11 = *(_WORD *)(v10 + 4);
                      v14 = *(_WORD *)(v10 + 6);
                      goto LABEL_32;
                    }
                  }
                }
                else
                {
LABEL_32:
                  *(_DWORD *)v10 = v2;
                  *(_WORD *)(v10 + 4) = v11 + 8;
                  v22 = v28;
                  *(_WORD *)(v10 + 6) = v14 + 8;
                  v10 &= -(__int64)(_InterlockedCompareExchange64((volatile signed __int64 *)(v22 + 40), v10, 0i64) != 0);
                }
                if( v10 )
                  ExFreePoolWithTag((PVOID)v10, 0x63734943u);
              }
              ExFreePoolWithTag(PoolWithTag, 0x63734943u);
            }
          }
        }
        break;
      }
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
}

Referenced by: