RtlGetPersistedStateLocation

NTSTATUS __fastcall RtlGetPersistedStateLocation(
        WCHAR *SourceString,
        const WCHAR *a2,
        _WORD *a3,
        UINT64 a4,
        VOID *a5,
        INT64 a6,
        INT64 a7){
  VOID **PoolWithTag; 
  NTSTATUS v11; 
  __int64 v13; 
  unsigned int v14; 
  size_t v15; 
  _WORD *v16; 
  NTSTATUS v17; 
  INT64 v18; 
  NTSTATUS v19; 
  unsigned int v20; 
  unsigned int v21; 
  NTSTATUS v22; 
  unsigned __int64 v23; 
  INT64 Length; 
  INT64 Lengtha; 
  UINT64 Lengthb; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  VOID *KeyHandle; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 v33; 

  KeyHandle = 0i64;
  Handle = 0i64;
  LODWORD(v33) = 0;
  PoolWithTag = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  if( (unsigned int)a4 > 1 )
    return -1073741583;
  if( byte_140C4C2E9 )
  {
    v11 = -1073741772;
  }
  else
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&qword_1409844A8[2 * (int)a4];
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v17 = ZwOpenKey(
            &KeyHandle,
            0x20019ui64,
            &ObjectAttributes,
            a4,
            Length,
            (INT64)ResultLength,
            (INT64)KeyHandle,
            (INT64)Handle);
    v11 = v17;
    if( v17 == -1073741772 )
    {
      byte_140C4C2E9 = 1;
    }
    else
    {
      if( v17 < 0 )
        goto LABEL_5;
      RtlInitUnicodeString(&DestinationString, SourceString);
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v19 = ZwOpenKey(
              &Handle,
              0x20019ui64,
              &ObjectAttributes,
              v18,
              Lengtha,
              (INT64)ResultLengtha,
              (INT64)KeyHandle,
              (INT64)Handle);
      v11 = v19;
      if( v19 != -1073741772 )
      {
        if( v19 < 0 )
          goto LABEL_5;
        if( !a2 )
          a2 = L"TargetNtPath";
        RtlInitUnicodeString(&DestinationString, a2);
        v20 = a6;
        v21 = a6 + 16;
        if( (int)a6 + 16 >= (unsigned int)a6 )
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, v21, 1885696883i64);
          if( !PoolWithTag )
          {
            v11 = -1073741801;
            goto LABEL_5;
          }
          LODWORD(Lengthb) = v21;
          v22 = ZwQueryValueKey(Handle, &DestinationString, KeyValuePartialInformation, PoolWithTag, Lengthb, &v33);
          v11 = v22;
          if( v22 < 0 )
          {
            if( v22 != -2147483643 )
              goto LABEL_5;
          }
          else if( *((_DWORD *)PoolWithTag + 1) != 1 )
          {
            v11 = -1073741788;
            goto LABEL_5;
          }
          v15 = *((_DWORD *)PoolWithTag + 2);
          LODWORD(v33) = v15;
          if( v22 >= 0 && *((_WORD *)PoolWithTag + ((unsigned __int64)v15 >> 1) + 5) )
          {
            v23 = v15 + 2;
            LODWORD(v33) = v23;
            v15 += 2;
            if( v20 < (unsigned int)v23 )
            {
              v11 = -2147483643;
            }
            else
            {
              *((_WORD *)PoolWithTag + (v23 >> 1) + 5) = 0;
              v15 = v33;
            }
          }
          if( a7 )
            *(_DWORD *)a7 = v15;
          if( v11 < 0 )
            goto LABEL_5;
          v16 = (_WORD *)PoolWithTag + 6;
          goto LABEL_19;
        }
LABEL_31:
        v11 = -1073741675;
        goto LABEL_5;
      }
    }
  }
  if( a3 )
  {
    v13 = -1i64;
    do
      ++v13;
    while( a3[v13] );
    v14 = v13 + 1;
    v15 = 2 * v14;
    LODWORD(v33) = 2 * v14;
    if( 2 * v14 >= v14 )
    {
      v11 = (unsigned int)a6 < v15 ? 0x80000005 : 0;
      if( a7 )
        *(_DWORD *)a7 = v15;
      if( v15 > (unsigned int)a6 )
        goto LABEL_5;
      v16 = a3;
LABEL_19:
      memmove(a5, v16, v15);
      goto LABEL_5;
    }
    goto LABEL_31;
  }
LABEL_5:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return v11;
}

Referenced by: