VrpPreOpenOrCreate

NTSTATUS __stdcall VrpPreOpenOrCreate(_REG_CREATE_KEY_INFORMATION_V1 *KeyInfo, VOID *JobContext){
  PUNICODE_STRING CompleteName; 
  _UNICODE_STRING *Buffer; 
  _UNICODE_STRING *v6; 
  VOID **v7; 
  _UNICODE_STRING *v8; 
  int v9; 
  NTSTATUS v10; 
  int v11; 
  VOID **PoolWithTag; 
  _UNICODE_STRING v13; 
  __int128 v14; 
  int v15; 
  __int128 v16; 
  PADAPTER_OBJECT v17; 
  __int128 v18; 
  _UNICODE_STRING *v20; 
  int Length; 
  __int64 v22; 
  char *v23; 
  _UNICODE_STRING *v24; 
  int v25; 
  int v26; 
  PADAPTER_OBJECT DmaAdapter; 
  _UNICODE_STRING *NewKeyPath; 
  _UNICODE_STRING NewPath; 
  PVOID P[2]; 
  __int128 v31; 
  _GUID ActivityId; 
  _EVENT_DATA_DESCRIPTOR v33; 
  int *v34; 
  __int64 v35; 
  __int64 v36; 
  int v37[2]; 
  int *v38; 
  __int64 v39; 

  CompleteName = KeyInfo->CompleteName;
  v26 = 0;
  Buffer = (_UNICODE_STRING *)CompleteName->Buffer;
  v6 = *(_UNICODE_STRING **)&CompleteName->Length;
  v7 = 0i64;
  v8 = (_UNICODE_STRING *)CompleteName[5].Buffer;
  DmaAdapter = 0i64;
  NewPath = 0i64;
  NewKeyPath = Buffer;
  *(_OWORD *)P = 0i64;
  v31 = 0i64;
  ActivityId = 0i64;
  EtwActivityIdControl(3ui64, &ActivityId);
  if( !v6->Length || *v6->Buffer != 92 )
  {
    if( !v8 )
      return 0;
    v9 = VrpBuildKeyPath(
           (_UNICODE_STRING *)((unsigned __int64)&v8[1] & -(__int64)(v8 != 0i64)),
           *(_UNICODE_STRING **)&CompleteName->Length,
           &NewPath);
    if( v9 < 0 )
      goto LABEL_15;
    goto LABEL_5;
  }
  v9 = VrpBuildKeyPath(0i64, *(_UNICODE_STRING **)&CompleteName->Length, &NewPath);
  if( v9 >= 0 )
  {
LABEL_5:
    v25 = 0;
    v10 = VrpTranslatePath((_UNICODE_STRING *)JobContext, NewKeyPath, v8, (VOID **)&NewPath, (_VRP_JOB_CONTEXT *)P);
    v9 = v10;
    if( v10 == -1073741772 )
      return 0;
    if( v10 < 0 )
      goto LABEL_15;
    v11 = v26;
    WORD1(DmaAdapter->AdapterObject.ScatterTranslations) = NewKeyPath[3].MaximumLength;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x48ui64, 1734693462i64);
    v7 = PoolWithTag;
    if( !PoolWithTag )
    {
      v9 = -1073741670;
      goto LABEL_21;
    }
    v13 = NewPath;
    *(_QWORD *)&CompleteName[5].Length = PoolWithTag;
    *PoolWithTag = CompleteName->Buffer;
    *((_OWORD *)PoolWithTag + 1) = *(_OWORD *)*(_QWORD *)&CompleteName->Length;
    v14 = *(_OWORD *)*(_QWORD *)&CompleteName[7].Length;
    v15 = v25;
    *((_UNICODE_STRING *)v7 + 3) = v13;
    *((_DWORD *)v7 + 16) = v11;
    v16 = v31;
    *((_OWORD *)v7 + 2) = v14;
    LODWORD(KeyInfo->RootObject) = v15;
    v17 = DmaAdapter;
    v18 = *(_OWORD *)P;
    v7[1] = JobContext;
    CompleteName->Buffer = &v17->AdapterObject.DmaHeader.Version;
    *(_OWORD *)*(_QWORD *)&CompleteName->Length = v18;
    *(_OWORD *)*(_QWORD *)&CompleteName[7].Length = v16;
  }
  if( v9 >= 0 )
    return v9;
LABEL_15:
  if( v9 == -1073740541 )
  {
    if( *(&stru_140C00F40 + 1162) > 5u )
    {
      v20 = (_UNICODE_STRING *)&EmptyUnicodeString;
      if( *(_QWORD *)(*(_QWORD *)&CompleteName->Length + 8i64) )
        v20 = *(_UNICODE_STRING **)&CompleteName->Length;
      Length = v20->Length;
      v22 = (__int64)v20->Buffer;
      v34 = v37;
      v23 = byte_140023258;
      v25 = -1073740541;
LABEL_25:
      v36 = v22;
      v37[0] = Length;
      v38 = &v25;
      v35 = 2i64;
      v37[1] = 0;
      v39 = 4i64;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&stru_140C00F40 + 4648,
        (unsigned __int8 *)v23,
        &ActivityId,
        0i64,
        5u,
        &v33);
      goto LABEL_26;
    }
    goto LABEL_26;
  }
LABEL_21:
  if( *(&stru_140C00F40 + 1162) > 2u )
  {
    v24 = (_UNICODE_STRING *)&EmptyUnicodeString;
    if( *(_QWORD *)(*(_QWORD *)&CompleteName->Length + 8i64) )
      v24 = *(_UNICODE_STRING **)&CompleteName->Length;
    Length = v24->Length;
    v22 = (__int64)v24->Buffer;
    v34 = v37;
    v23 = &byte_140023297;
    v25 = v9;
    goto LABEL_25;
  }
LABEL_26:
  if( v7 )
    ExFreePoolWithTag(v7, 0x67655256u);
  if( P[1] )
    ExFreePoolWithTag(P[1], 0x67655256u);
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( NewPath.Buffer )
    ExFreePoolWithTag(NewPath.Buffer, 0x67655256u);
  return v9;
}

Referenced by: