VrpPostQueryKey

NTSTATUS __stdcall VrpPostQueryKey(_REG_POST_OPERATION_INFORMATION *PostInfo, _VRP_JOB_CONTEXT *JobContext){
  _QWORD *ObjectContext; 
  VOID **PreInformation; 
  INT8 PreviousMode; 
  __int64 v6; 
  int Status; 
  __int64 *v8; 
  INT8 v9; 
  unsigned int v10; 
  VOID **v11; 
  unsigned int v13; 
  NTSTATUS v14; 
  NTSTATUS v15; 
  __int64 *v16; 
  bool v17; 
  __int64 *v18; 
  UINT64 KeyFlags; 
  NTSTATUS updated; 
  unsigned int v21; 
  PVOID BufferUsed; 
  PVOID SuspectBuffer; 
  _REG_POST_OPERATION_INFORMATION *v24; 
  _LPGUID ActivityId[4]; 
  _EVENT_DATA_DESCRIPTOR v26[2]; 
  __int64 *v27; 
  __int64 v28; 
  __int64 *v29; 
  __int64 v30; 
  int *p_updated; 
  __int64 v32[3]; 

  v24 = PostInfo;
  *(_OWORD *)ActivityId = 0i64;
  EtwActivityIdControl(3ui64, (_GUID *)ActivityId);
  ObjectContext = PostInfo->ObjectContext;
  PreInformation = (VOID **)PostInfo->PreInformation;
  BufferUsed = 0i64;
  PreviousMode = ExGetPreviousMode();
  Status = PostInfo->Status;
  v8 = &EmptyUnicodeString;
  SuspectBuffer = 0i64;
  v9 = PreviousMode;
  if( Status < 0 && Status != -1073741789 && Status != -2147483643 )
    goto LABEL_4;
  v10 = *((_DWORD *)PreInformation + 2);
  if( v10 > 8 )
    goto LABEL_4;
  v6 = 283i64;
  if( !_bittest((const int *)&v6, v10) )
    goto LABEL_4;
  if( *(&stru_140C00F40 + 1162) > 5u )
  {
    v16 = ObjectContext + 2;
    v21 = *((_DWORD *)PreInformation + 2);
    v28 = 4i64;
    v27 = (__int64 *)&v21;
    if( !ObjectContext[3] )
      v16 = &EmptyUnicodeString;
    v30 = 2i64;
    v29 = v32;
    p_updated = (int *)v16[1];
    v32[0] = *(unsigned __int16 *)v16;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 4648,
      (unsigned __int8 *)&word_14002345E,
      (const _GUID *)ActivityId,
      0i64,
      5u,
      v26);
  }
  if( (*((_DWORD *)ObjectContext + 9) & 0x20000000) == 0 )
  {
    v13 = *((_DWORD *)PreInformation + 2);
    if( v13 != 3 && v13 != 8 )
      goto LABEL_4;
  }
  Status = VrpProcessBufferParameter(v9, PreInformation[2], *((unsigned int *)PreInformation + 6), &BufferUsed);
  if( Status >= 0 )
  {
    Status = VrpOutputBufferParameter(v9, BufferUsed, *((unsigned int *)PreInformation + 6), PreInformation + 2);
    if( Status >= 0 )
    {
      Status = VrpProcessBufferParameter(v9, PreInformation[4], 4ui64, &SuspectBuffer);
      if( Status >= 0 )
      {
        Status = VrpOutputBufferParameter(v9, SuspectBuffer, 4ui64, PreInformation + 4);
        if( Status >= 0 )
        {
          LODWORD(KeyFlags) = *((_DWORD *)ObjectContext + 9);
          updated = VrpUpdateKeyInformation(
                      *((_KEY_INFORMATION_CLASS *)PreInformation + 2),
                      BufferUsed,
                      *((unsigned int *)PreInformation + 6),
                      (UINT64 *)SuspectBuffer,
                      (_UNICODE_STRING *)ObjectContext + 1,
                      KeyFlags);
          Status = updated;
          if( updated >= 0 || updated == -2147483643 || updated == -1073741789 )
          {
            v14 = VrpOutputBufferParameter(v9, PreInformation[2], *((unsigned int *)PreInformation + 6), &BufferUsed);
            if( v14 < 0 )
            {
              Status = v14;
            }
            else
            {
              v15 = VrpOutputBufferParameter(v9, PreInformation[4], 4ui64, &SuspectBuffer);
              if( v15 < 0 )
              {
                Status = v15;
              }
              else
              {
                v24->ReturnStatus = updated;
                Status = -1073740541;
                if( *(&stru_140C00F40 + 1162) <= 5u )
                  goto LABEL_5;
                v17 = ObjectContext[3] == 0i64;
                v18 = &EmptyUnicodeString;
                v28 = 2i64;
                if( !v17 )
                  v18 = ObjectContext + 2;
                v32[0] = 4i64;
                v27 = &v30;
                v32[2] = 4i64;
                v29 = (__int64 *)v18[1];
                v30 = *(unsigned __int16 *)v18;
                v21 = *((_DWORD *)PreInformation + 2);
                p_updated = (int *)&v21;
                v32[1] = (__int64)&updated;
                tlgWriteTransfer_EtwWriteTransfer(
                  (__int64)&stru_140C00F40 + 4648,
                  (unsigned __int8 *)word_14002351A,
                  (const _GUID *)ActivityId,
                  0i64,
                  6u,
                  v26);
              }
            }
          }
LABEL_4:
          if( Status >= 0 )
            goto LABEL_5;
        }
      }
    }
  }
  if( Status != -1073740541 && *(&stru_140C00F40 + 1162) > 2u )
  {
    if( ObjectContext[3] )
      v8 = ObjectContext + 2;
    v28 = 2i64;
    v27 = &v30;
    v29 = (__int64 *)v8[1];
    v30 = *(unsigned __int16 *)v8;
    p_updated = &updated;
    updated = Status;
    v32[0] = 4i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 4648,
      (unsigned __int8 *)&dword_14002349C,
      (const _GUID *)ActivityId,
      0i64,
      5u,
      v26);
  }
LABEL_5:
  LOBYTE(v6) = v9;
  VrpCleanupBufferParameter((VOID **)v6, &BufferUsed);
  LOBYTE(v11) = v9;
  VrpCleanupBufferParameter(v11, &SuspectBuffer);
  return Status;
}

Referenced by: