OpenGlobalizationUserSettingsKey_ForMua

INT64 __fastcall OpenGlobalizationUserSettingsKey_ForMua(INT64 a1, INT64 a2, HANDLE *a3, _DWORD *a4){
  __int64 v4; 
  int v7; 
  UINT64 v8; 
  __int64 *Memory; 
  int InformationToken; 
  unsigned __int8 v11; 
  __int64 v12; 
  wchar_t *v13; 
  wchar_t *v14; 
  UINT64 v16; 
  ULONG ReturnLength[2]; 
  struct _UNICODE_STRING Destination; 
  struct _UNICODE_STRING UnicodeString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR Source[264]; 
  v4 = 0i64;
  v7 = 0;
  UnicodeString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Memory = (__int64 *)AllocateMemory((UINT16 *)0x54);
  if( Memory )
  {
    ReturnLength[0] = 0;
    InformationToken = ZwQueryInformationToken((HANDLE)0xFFFFFFFFFFFFFFFAi64, TokenUser, Memory, 0x54u, ReturnLength);
    if( InformationToken < 0 )
      goto LABEL_26;
    v4 = *Memory;
  }
  else
  {
    InformationToken = -1073741801;
  }
  if( InformationToken >= 0 )
  {
    v11 = *(_BYTE *)(v4 + 1);
    if( v11 < 2u || v11 == 5 && *(_DWORD *)(v4 + 8) == 21 && *(_DWORD *)(v4 + 24) == 503 )
    {
      *a4 = 0;
      InformationToken = -1073741514;
      v7 = 1;
    }
    if( InformationToken >= 0 )
    {
      InformationToken = RtlConvertSidToUnicodeString(&UnicodeString, (PVOID)v4, 1u);
      if( InformationToken >= 0 )
      {
        ReturnLength[0] = 0;
        LODWORD(v16) = 520;
        InformationToken = RtlGetPersistedStateLocation(
                             (WCHAR *)L"GlobalizationUserSettings",
                             L"TargetNtPath",
                             L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\International",
                             0i64,
                             Source,
                             v16,
                             (UINT64 *)ReturnLength);
        if( InformationToken >= 0 )
        {
          v12 = (unsigned __int16)(LOWORD(ReturnLength[0]) + UnicodeString.Length + 4);
          v13 = (wchar_t *)AllocateMemory((UINT16 *)(unsigned __int16)v12);
          v14 = v13;
          if( v13 )
          {
            *(_QWORD *)&Destination.Length = 0i64;
            Destination.MaximumLength = v12;
            Destination.Buffer = v13;
            InformationToken = RtlAppendUnicodeToString(&Destination, Source);
            if( InformationToken >= 0 )
            {
              InformationToken = RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\\");
              if( InformationToken >= 0 )
              {
                InformationToken = RtlAppendUnicodeStringToString(&Destination, &UnicodeString);
                if( InformationToken >= 0 )
                {
                  ObjectAttributes.RootDirectory = 0i64;
                  *(_QWORD *)ReturnLength = 0i64;
                  ObjectAttributes.ObjectName = &Destination;
                  ObjectAttributes.Length = 48;
                  ObjectAttributes.Attributes = 576;
                  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
                  if( ZwOpenKey((PHANDLE)ReturnLength, 0x20019u, &ObjectAttributes) < 0 )
                  {
                    v7 = 1;
                    *a4 = 1;
                  }
                  else
                  {
                    ZwClose(*(HANDLE *)ReturnLength);
                    *a4 = 2;
                    InformationToken = ZwOpenKey(a3, 8u, &ObjectAttributes);
                  }
                }
              }
            }
            ExFreeHeapPool(v14);
          }
          else
          {
            InformationToken = -1073741801;
          }
        }
        RtlFreeAnsiString(&UnicodeString);
      }
    }
    if( v7 )
      InformationToken = OpenGlobalizationUserSettingsKey_ForSingleUserModel(v8, a3);
  }
LABEL_26:
  if( Memory )
    ExFreeHeapPool(Memory);
  return(unsigned int)InformationToken;
}

Referenced by: