SdbpCheckMatchingRegistryEntry

NTSTATUS __stdcall SdbpCheckMatchingRegistryEntry(
        PWCHAR pwszKeyPath,
        PWCHAR pwszValueNameDb,
        UINT64 ulValueTypeDb,
        PWCHAR pwszValueDataDb,
        UINT64 dwValueDataDb,
        UINT64 qwValueDataDb,
        UINT8 *pValueDataDb,
        UINT64 pValueDataSize,
        INT64 *bEntryMatchedOut){
  unsigned int v10; 
  NTSTATUS v12; 
  INT64 v13; 
  INT64 v14; 
  int v15; 
  INT64 a5; 
  INT64 a5a; 
  INT64 a6; 
  INT64 a6a; 
  PVOID buf1; 
  PVOID buf1a; 
  INT64 count; 
  INT64 counta; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _UNICODE_STRING DestinationString; 
  __int64 v28; 
  int v29; 
  WCHAR pszDest[264]; 

  pszDest[0] = 0;
  KeyHandle = 0i64;
  v28 = 0i64;
  v10 = ulValueTypeDb;
  *(_DWORD *)bEntryMatchedOut = 0;
  v29 = 0;
  v12 = 0;
  DestinationString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( RtlStringCchPrintfW(pszDest, 0x104ui64, (WCHAR *)L"\\REGISTRY\\MACHINE\\%s") < 0 )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbpCheckMatchingRegistryEntry",
      0x4E4ui64,
      (INT8 *)"Failed to construct full key path");
    goto LABEL_10;
  }
  RtlInitUnicodeString(&DestinationString, pszDest);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v13, a5, a6, (INT64)buf1, count) >= 0 )
    goto LABEL_9;
  ZwQuerySystemInformation();
  if( v15 < 0 )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbpCheckMatchingRegistryEntry",
      0x507ui64,
      (INT8 *)"Failed to get processor architecture [%x]");
    goto LABEL_10;
  }
  if( (_WORD)v28 == 9
    && ZwOpenKey(&KeyHandle, 0x20219ui64, &ObjectAttributes, v14, a5a, a6a, (INT64)buf1a, counta) >= 0 )
  {
LABEL_9:
    LODWORD(a5a) = dwValueDataDb;
    v12 = SdbpCheckMatchingRegistryValue(
            (_HANDLE)KeyHandle,
            pwszValueNameDb,
            v10,
            pwszValueDataDb,
            a5a,
            qwValueDataDb,
            pValueDataDb,
            pValueDataSize,
            (INT64)bEntryMatchedOut);
  }
  else
  {
    v12 = 1;
  }
LABEL_10:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v12;
}

Referenced by: