OpenGlobalizationUserSettingsKey_ForMua

__int64 __fastcall OpenGlobalizationUserSettingsKey_ForMua(__int64 a1, __int64 a2, VOID **a3, _DWORD *a4){
  __int64 v4; 
  int v7; 
  UINT64 v8; 
  UINT64 v9; 
  _UNICODE_STRING *v10; 
  VOID **v11; 
  __int64 *v12; 
  NTSTATUS InformationToken; 
  unsigned __int8 v14; 
  unsigned __int16 v15; 
  wchar_t *v16; 
  wchar_t *v17; 
  INT64 v18; 
  INT64 v19; 
  UINT64 *ReturnLength; 
  UINT64 *ReturnLengtha; 
  INT64 a6; 
  INT64 a6a; 
  INT64 a6b; 
  INT64 a7; 
  INT64 a7a; 
  INT64 v28; 
  INT64 v29; 
  UINT64 v30; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING UnicodeString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 a5[264]; 

  v4 = 0i64;
  v7 = 0;
  UnicodeString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  LODWORD(v8) = AllocateMemory(84);
  v12 = (__int64 *)v8;
  if( v8 )
  {
    LODWORD(v30) = 0;
    InformationToken = ZwQueryInformationToken(0xFFFFFFFFFFFFFFFAui64, 1i64, v8, 0x54ui64, (UINT64)&v30);
    if( InformationToken < 0 )
      goto LABEL_26;
    v4 = *v12;
  }
  else
  {
    InformationToken = -1073741801;
  }
  if( InformationToken >= 0 )
  {
    v14 = *(_BYTE *)(v4 + 1);
    if( v14 < 2u || v14 == 5 && *(_DWORD *)(v4 + 8) == 21 && *(_DWORD *)(v4 + 24) == 503 )
    {
      *a4 = 0;
      InformationToken = -1073741514;
      v7 = 1;
    }
    if( InformationToken >= 0 )
    {
      InformationToken = RtlConvertSidToUnicodeString(&UnicodeString, (VOID *)v4, 1u);
      if( InformationToken >= 0 )
      {
        LODWORD(v30) = 0;
        LODWORD(a6) = 520;
        InformationToken = RtlGetPersistedStateLocation(
                             (WCHAR *)L"GlobalizationUserSettings",
                             L"TargetNtPath",
                             L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\International",
                             0i64,
                             a5,
                             a6,
                             (INT64)&v30);
        if( InformationToken >= 0 )
        {
          v15 = v30 + UnicodeString.Length + 4;
          LODWORD(v16) = AllocateMemory(v15);
          v17 = v16;
          if( v16 )
          {
            *(_QWORD *)&Destination.Length = 0i64;
            Destination.MaximumLength = v15;
            Destination.Buffer = v16;
            InformationToken = RtlAppendUnicodeToString(&Destination, (WCHAR *)a5);
            if( InformationToken >= 0 )
            {
              InformationToken = RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\");
              if( InformationToken >= 0 )
              {
                InformationToken = RtlAppendUnicodeStringToString(&Destination, &UnicodeString);
                if( InformationToken >= 0 )
                {
                  ObjectAttributes.RootDirectory = 0i64;
                  v30 = 0i64;
                  ObjectAttributes.ObjectName = &Destination;
                  ObjectAttributes.Length = 48;
                  ObjectAttributes.Attributes = 576;
                  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
                  if( ZwOpenKey((VOID **)&v30, 0x20019ui64, &ObjectAttributes, v18, (INT64)ReturnLength, a6a, a7, v28) < 0 )
                  {
                    v7 = 1;
                    *a4 = 1;
                  }
                  else
                  {
                    ZwClose(v30);
                    *a4 = 2;
                    InformationToken = ZwOpenKey(a3, 8ui64, &ObjectAttributes, v19, (INT64)ReturnLengtha, a6b, a7a, v29);
                  }
                }
              }
            }
            ExFreeHeapPool(v17);
          }
          else
          {
            InformationToken = -1073741801;
          }
        }
        RtlFreeAnsiString(&UnicodeString);
      }
    }
    if( v7 )
      InformationToken = OpenGlobalizationUserSettingsKey_ForSingleUserModel(v9, a3, v10, v11);
  }
LABEL_26:
  if( v12 )
    ExFreeHeapPool(v12);
  return(unsigned int)InformationToken;
}

Referenced by: