PiCMOpenObjectKey

NTSTATUS __stdcall PiCMOpenObjectKey(
        VOID *IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        VOID *IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  unsigned int v5; 
  char PreviousMode; 
  NTSTATUS v8; 
  unsigned int v9; 
  int v10; 
  UINT64 v11; 
  NTSTATUS v12; 
  __int64 v14; 
  VOID **IoctlOutputBufferSizea; 
  INT64 v16; 
  INT64 v17; 
  PVOID SourceHandle; 
  VOID *Handle; 
  __int128 v20; 
  UINT64 *DesiredAccess[2]; 
  UINT64 ExpectedOutputSize[2]; 
  UINT64 *v23; 

  Handle = 0i64;
  SourceHandle = 0i64;
  v5 = IoctlOutputBufferSize;
  v20 = 0i64;
  *(_DWORD *)v23 = 0;
  *(_OWORD *)DesiredAccess = 0i64;
  *(_OWORD *)ExpectedOutputSize = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v8 = PiCMCaptureRegistryInputData(IoctlInputBuffer, IoctlInputBufferSize, (int)BytesUsed, (__int64)&v20);
  if( v8 < 0 )
    goto LABEL_21;
  if( !DesiredAccess[0] || DWORD1(v20) || HIDWORD(ExpectedOutputSize[0]) || !IoctlOutputBuffer || v5 < 0x10 )
    goto LABEL_48;
  v9 = 0;
  if( SDWORD2(v20) <= 6 )
  {
    switch( DWORD2(v20) )
    {
      case 6:
        v9 = 6;
        goto LABEL_45;
      case 1:
        v9 = 1;
LABEL_46:
        v8 = -1073741637;
        goto LABEL_14;
      case 2:
        v9 = 2;
        goto LABEL_14;
      case 3:
        v9 = 4;
        goto LABEL_14;
      case 4:
        v9 = 3;
        goto LABEL_45;
      case 5:
        v9 = 5;
        goto LABEL_45;
    }
  }
  else
  {
    switch( DWORD2(v20) )
    {
      case 0x10001:
        v10 = 7;
        goto LABEL_11;
      case 0x10002:
        v10 = 8;
LABEL_11:
        v9 = *(&stru_140CF2E80 + 608) != 0i64 ? v10 : 0;
        break;
      case 0x10003:
        v10 = 9;
        goto LABEL_11;
      case 0x10004:
        v10 = 10;
        goto LABEL_11;
      case 0x10005:
        v10 = 11;
        goto LABEL_11;
    }
  }
  if( !v9 )
  {
LABEL_48:
    v8 = -1073741811;
    goto LABEL_18;
  }
  if( v9 > 6 || v9 <= 4 )
    goto LABEL_14;
LABEL_45:
  if( LODWORD(ExpectedOutputSize[0]) == 1 )
    goto LABEL_46;
LABEL_14:
  if( v8 >= 0 )
  {
    v8 = PnpOpenObjectRegKey(
           *(&stru_140CF2E80 + 607),
           (__int64)DesiredAccess[0],
           v9,
           SHIDWORD(DesiredAccess[1]),
           0,
           (__int64)&SourceHandle);
    if( v8 != -1073741772 )
      goto LABEL_16;
    if( LODWORD(ExpectedOutputSize[0]) == 1 )
    {
      if( PiAuDoesClientHaveAccess(2ui64) )
      {
        v8 = PnpCreateObject(v14, (UINT64)DesiredAccess[0], v9, SHIDWORD(DesiredAccess[1]), &SourceHandle);
LABEL_16:
        if( v8 >= 0 )
        {
          IoctlOutputBufferSizea = &Handle;
          PiCMDuplicateRegistryHandle(SourceHandle, v11, (UINT64 *)HIDWORD(DesiredAccess[1]), PreviousMode);
          v8 = v12;
        }
        goto LABEL_18;
      }
      v8 = -1073741790;
    }
  }
LABEL_18:
  LODWORD(IoctlOutputBufferSizea) = v5;
  v8 = PiCMReturnHandleResultData(
         (unsigned int)v8,
         Handle,
         LODWORD(ExpectedOutputSize[1]),
         IoctlOutputBuffer,
         (UINT64)IoctlOutputBufferSizea,
         v23,
         v16,
         v17);
  if( SourceHandle )
    ZwClose((_HANDLE)SourceHandle);
  if( v8 < 0 && Handle )
    ObCloseHandle(Handle, PreviousMode);
LABEL_21:
  PiCMReleaseRegistryInputData((__int64)&v20);
  return v8;
}

Referenced by: