SysCtxOpenControlSet
NTSTATUS __stdcall SysCtxOpenControlSet(VOID *SystemKey, VOID *TransactionHandle, VOID **phkControlSet){
VOID **v3;
VOID **v5;
char v7;
NTSTATUS KeyTransacted;
NTSTATUS v10;
VOID **phkResult;
VOID *hTransaction;
VOID *hTransactiona;
int v14[4];
int v15;
_DWORD KeyHandle[3];
WCHAR pszDest[16];
*v3 = 0i64;
v14[0] = 0;
*(_QWORD *)&KeyHandle[1] = 0i64;
v5 = v3;
v15 = 0;
v7 = 0;
KeyTransacted = RegRtlOpenKeyTransacted(
TransactionHandle,
L"CurrentControlSet",
0i64,
0x2000000ui64,
v3,
phkControlSet);
if( KeyTransacted == -1073741772 )
{
KeyTransacted = RegRtlOpenKeyTransacted(
TransactionHandle,
L"Select",
0i64,
1ui64,
(VOID **)&KeyHandle[1],
phkControlSet);
if( KeyTransacted == -1073741772 )
{
LOBYTE(hTransaction) = 0;
KeyTransacted = RegRtlCreateKeyTransacted(
TransactionHandle,
L"Select",
0i64,
3i64,
0i64,
(INT64)hTransaction,
(VOID **)&KeyHandle[1],
0i64,
phkControlSet);
}
if( !KeyTransacted )
{
KeyHandle[0] = 4;
v10 = RegRtlQueryValue(*(VOID **)&KeyHandle[1], L"Current", &v15, v14, (__int64)KeyHandle);
KeyTransacted = v10;
if( v10 == -1073741772 )
{
v14[0] = 1;
LODWORD(phkResult) = 4;
v7 = 1;
KeyTransacted = RegRtlSetValue(*(VOID **)&KeyHandle[1], L"Current", 4u, v14, (UINT64)phkResult);
if( KeyTransacted )
goto LABEL_2;
}
else
{
if( v10 )
goto LABEL_2;
if( v15 != 4 || KeyHandle[0] != 4 )
goto LABEL_19;
}
if( v14[0] <= 0x3E7u && RtlStringCchPrintfW(pszDest, 0xEui64, (WCHAR *)L"ControlSet%03d") >= 0 )
{
KeyTransacted = RegRtlOpenKeyTransacted(TransactionHandle, pszDest, 0i64, 0x2000000ui64, v5, phkControlSet);
if( KeyTransacted == -1073741772 && v7 )
{
LOBYTE(hTransactiona) = 0;
KeyTransacted = RegRtlCreateKeyTransacted(
TransactionHandle,
pszDest,
0i64,
0x2000000i64,
0i64,
(INT64)hTransactiona,
v5,
0i64,
phkControlSet);
}
goto LABEL_2;
}
LABEL_19:
KeyTransacted = -1073741811;
}
}
LABEL_2:
if( *(_QWORD *)&KeyHandle[1] )
ZwClose(KeyHandle[1]);
return KeyTransacted;
}Referenced by:
SysCtxOpenMachine