RtlpGetRegistryHandle

INT64 __fastcall RtlpGetRegistryHandle(UINT64 RelativeTo, const WCHAR *KeyName, UINT8 WriteAccess, VOID **Key){
  __int64 v7; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v9; 
  wchar_t *v10; 
  NTSTATUS appended; 
  NTSTATUS v12; 
  struct _KPRCB *v13; 
  struct _SLIST_ENTRY *Buffer; 
  __int64 v15; 
  __int64 v17; 
  __int64 v18; 
  __int64(__fastcall *v19)(__int64, __int64, __int64); 
  __int64 v20; 
  __int64 v21; 
  UINT64 CreateOptions; 
  struct _UNICODE_STRING Destination; 
  struct _UNICODE_STRING KeyPath; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  *(_DWORD *)(&Destination.MaximumLength + 1) = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyPath = 0i64;
  if( (RelativeTo & 0x40000000) != 0 )
  {
    *Key = (VOID *)KeyName;
    return 0i64;
  }
  else
  {
    v7 = (unsigned int)RelativeTo;
    LODWORD(v7) = RelativeTo & 0x7FFFFFFF;
    if( (RelativeTo & 0x80000000) == 0i64 )
      v7 = (unsigned int)RelativeTo;
    if( (unsigned int)v7 >= 6 )
    {
      return 3221225485i64;
    }
    else
    {
      CurrentPrcb = KeGetCurrentPrcb();
      v9 = *((_QWORD *)CurrentPrcb + 272);
      ++*(_DWORD *)(v9 + 20);
      v10 = (wchar_t *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v9);
      if( v10 )
        goto LABEL_6;
      ++*(_DWORD *)(v9 + 24);
      v17 = *((_QWORD *)CurrentPrcb + 273);
      ++*(_DWORD *)(v17 + 20);
      v10 = (wchar_t *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v17);
      if( v10
        || (v18 = *(unsigned int *)(v17 + 44),
            v19 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v17 + 48),
            v20 = *(unsigned int *)(v17 + 40),
            v21 = *(unsigned int *)(v17 + 36),
            ++*(_DWORD *)(v17 + 24),
            (v10 = (wchar_t *)v19(v21, v18, v20)) != 0i64) )
      {
LABEL_6:
        *(_DWORD *)v10 = *((_DWORD *)CurrentPrcb + 9);
      }
      Destination.Buffer = v10;
      if( v10 )
      {
        *(_DWORD *)&Destination.Length = 34340864;
        if( !(_DWORD)v7 )
          goto LABEL_13;
        if( (_DWORD)v7 == 5 && (int)RtlFormatCurrentUserKeyPath(&KeyPath) >= 0 )
        {
          appended = RtlAppendUnicodeStringToString(&Destination, &KeyPath);
          RtlFreeAnsiString(&KeyPath);
        }
        else
        {
          appended = RtlAppendUnicodeToString(&Destination, (PWCHAR)RtlpRegistryPaths[v7]);
        }
        if( appended >= 0 )
        {
          appended = RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\\");
          if( appended >= 0 )
          {
LABEL_13:
            appended = RtlAppendUnicodeToString(&Destination, (PWCHAR)KeyName);
            if( appended >= 0 )
            {
              ObjectAttributes.Length = 48;
              ObjectAttributes.ObjectName = &Destination;
              ObjectAttributes.RootDirectory = 0i64;
              ObjectAttributes.Attributes = 576;
              *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
              if( WriteAccess )
              {
                LODWORD(CreateOptions) = 0;
                v12 = ZwCreateKey(Key, 0x40000000ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
              }
              else
              {
                v12 = ZwOpenKey(Key, 0x82000000, &ObjectAttributes);
              }
              appended = v12;
            }
          }
        }
        v13 = KeGetCurrentPrcb();
        Buffer = (struct _SLIST_ENTRY *)Destination.Buffer;
        v15 = *((_QWORD *)v13 + 272);
        ++*(_DWORD *)(v15 + 28);
        if( *(_WORD *)v15 < *(_WORD *)(v15 + 16)
          || (++*(_DWORD *)(v15 + 32),
              v15 = *((_QWORD *)v13 + 273),
              ++*(_DWORD *)(v15 + 28),
              *(_WORD *)v15 < *(_WORD *)(v15 + 16)) )
        {
          RtlpInterlockedPushEntrySList((PSLIST_HEADER)v15, Buffer);
        }
        else
        {
          ++*(_DWORD *)(v15 + 32);
          (*(void(__fastcall **)(struct _SLIST_ENTRY *))(v15 + 56))(Buffer);
        }
        return(unsigned int)appended;
      }
      else
      {
        return 3221225495i64;
      }
    }
  }
}

Referenced by: