NtQueryOpenSubKeys

NTSTATUS __stdcall NtQueryOpenSubKeys(_OBJECT_ATTRIBUTES *TargetKey, UINT64 *HandleCount){
  char v4; 
  bool v5; 
  NTSTATUS v6; 
  char v7; 
  __int64 v8; 
  PADAPTER_OBJECT v9; 
  int v10; 
  INT64 v12; 
  PADAPTER_OBJECT DmaAdapter; 
  int v14; 
  KAPC_STATE ApcState; 
  INT64 result[12]; 
  int v17; 
  _QWORD v18[9]; 
  INT64 v19[11]; 
  v14 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  DmaAdapter = 0i64;
  memset((INT64)result, 0i64);
  v17 = -1;
  v18[1] = v18;
  v18[0] = v18;
  memset((INT64)v19, 0i64);
  v4 = 0;
  v5 = CmpAcquireShutdownRundown();
  if( v5 )
  {
    v7 = *((_BYTE *)KeGetCurrentThread() + 562);
    if( v7 == 1 )
    {
      v8 = (__int64)HandleCount;
      if( (unsigned __int64)HandleCount >= 0x7FFFFFFF0000i64 )
        v8 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v8 = *(_DWORD *)v8;
    }
    LOBYTE(v12) = v7;
    v6 = ObReferenceObjectByNameEx(
           (__int64)TargetKey,
           0i64,
           0x20019u,
           (__int64)CmKeyObjectType,
           v12,
           (__int64)result,
           &DmaAdapter);
    if( v6 >= 0 )
    {
      CmpLockRegistryExclusive();
      v4 = 1;
      v9 = DmaAdapter;
      v6 = CmpPerformKeyBodyDeletionCheck((__int64)DmaAdapter, 0i64);
      if( v6 >= 0 )
      {
        if( ((__int64)v9->DmaOperations->MapTransferEx & 0x40000) != 0 )
        {
          CmpAttachToRegistryProcess(&ApcState);
          v10 = CmpSearchForOpenSubKeys((INT64)v9->DmaOperations, 0i64, 0i64);
          CmpDetachFromRegistryProcess(&ApcState);
          CmpUnlockRegistry();
          v4 = 0;
          *(_DWORD *)HandleCount = v10;
          v6 = 0;
        }
        else
        {
          v6 = -1073741811;
        }
      }
    }
  }
  else
  {
    v6 = -1073741431;
  }
  if( v4 )
    CmpUnlockRegistry();
  CmpCleanupParseContext((__int64)result, 0);
  if( v5 )
    CmpReleaseShutdownRundown();
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  return v6;
}

Referenced by: