NtLockProductActivationKeys

NTSTATUS __stdcall NtLockProductActivationKeys(UINT64 *pPrivateVer, UINT64 *pSafeMode){
  NTSTATUS v3; 
  __int16 v4; 
  unsigned __int64 i; 
  __int16 v6; 
  __int64 j; 
  unsigned int v8; 
  unsigned int v9; 
  unsigned int v10; 
  int v11; 
  unsigned __int64 v12; 
  INT64 v13; 
  NTSTATUS result; 
  NTSTATUS v15; 
  unsigned int v16; 
  NTSTATUS k; 
  NTSTATUS v18; 
  INT64 v19; 
  NTSTATUS v20; 
  NTSTATUS v21; 
  __int64 v22; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 Lengthb; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  INT64 WasLocked; 
  VOID *Handle_4; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v32; 
  _OBJECT_ATTRIBUTES v33; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR SourceString[8]; 
  __int128 v36; 
  __int128 v37; 
  __int64 v38; 
  int v39; 
  char KeyInformation[12]; 
  unsigned int v41; 
  __int16 Src[504]; 
  wchar_t Dst[512]; 

  DestinationString = 0i64;
  v3 = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  HIDWORD(WasLocked) = 0;
  *(_OWORD *)SourceString = xmmword_14001F638;
  v36 = xmmword_14001F648;
  v37 = xmmword_14001F658;
  v38 = 0x2C7EFB57828734DAi64;
  v39 = 593434642;
  v4 = -21647;
  for( i = 0i64; i < 0x1E; ++i )
  {
    v6 = SourceString[i] ^ (v4 + SourceString[i]);
    v4 = v6;
  }
  if( v6 != -18097 )
    return -1073741823;
  for( j = 52i64; j >= 0; --j )
  {
    v8 = *(_DWORD *)((char *)SourceString + j);
    v9 = *(_DWORD *)((char *)&SourceString[2] + j);
    v10 = -957401312;
    v11 = 32;
    v12 = 3337565984i64;
    do
    {
      v9 -= (v10 + *(_DWORD *)&abWPAStringKey[4 * ((v12 >> 11) & 3)]) ^ (v8 + ((16 * v8) ^ (v8 >> 5)));
      v10 += 1640531527;
      v12 = v10;
      v8 -= (v10 + *(_DWORD *)&abWPAStringKey[4 * (v10 & 3)]) ^ (v9 + ((16 * v9) ^ (v9 >> 5)));
      --v11;
    }
    while( v11 );
    *(_DWORD *)((char *)SourceString + j) = v8;
    *(_DWORD *)((char *)&SourceString[2] + j) = v9;
  }
  RtlInitUnicodeString(&DestinationString, SourceString);
  if( KeGetCurrentThread()->PreviousMode )
  {
    if( pSafeMode )
    {
      v22 = (__int64)pSafeMode;
      if( (unsigned __int64)pSafeMode >= 0x7FFFFFFF0000i64 )
        v22 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v22 = *(_DWORD *)v22;
      *(_DWORD *)pSafeMode = InitSafeBootMode;
    }
  }
  else if( pSafeMode )
  {
    *(_DWORD *)pSafeMode = InitSafeBootMode;
  }
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenKey(
             &KeyHandle,
             0x20019ui64,
             &ObjectAttributes,
             v13,
             Length,
             (INT64)ResultLength,
             WasLocked,
             (INT64)Handle_4);
  v15 = result;
  if( result >= 0 )
  {
    v16 = 0;
    LODWORD(Lengtha) = 1024;
    for( k = ZwEnumerateKey(
                KeyHandle,
                0i64,
                KeyBasicInformation,
                KeyInformation,
                Lengtha,
                (UINT64 *)((char *)&WasLocked + 4));
          ;
          k = ZwEnumerateKey(
                KeyHandle,
                v16,
                KeyBasicInformation,
                KeyInformation,
                Lengthb,
                (UINT64 *)((char *)&WasLocked + 4)) )
    {
      v18 = k;
      if( k == -2147483622 )
        break;
      v32 = 0i64;
      memset(&v33, 0, sizeof(v33));
      Handle_4 = 0i64;
      if( k < 0 )
      {
        v15 = k;
        break;
      }
      if( v41 + 64 > 0x400 )
      {
        v15 = -1073741801;
      }
      else
      {
        wcscpy_s(Dst, 0x200ui64, SourceString);
        wcsncat_s(Dst, 0x200ui64, (WCHAR *)Src, (unsigned __int64)v41 >> 1);
        wcscat_s(Dst, 0x200ui64, (WCHAR *)L"\\");
        RtlInitUnicodeString(&v32, Dst);
        v33.Length = 48;
        v33.RootDirectory = 0i64;
        v33.Attributes = 576;
        v33.ObjectName = &v32;
        *(_OWORD *)&v33.SecurityDescriptor = 0i64;
        v20 = ZwOpenKey(&Handle_4, 0x20019ui64, &v33, v19, Lengthb, (INT64)ResultLengtha, WasLocked, (INT64)Handle_4);
        if( v20 < 0 )
        {
          v15 = v20;
        }
        else
        {
          LOBYTE(WasLocked) = 0;
          v21 = IsRegistryKeyLocked(Handle_4, (UINT8 *)&WasLocked);
          if( v21 >= 0 && !(_BYTE)WasLocked )
            v21 = ZwLockRegistryKey(Handle_4);
          ZwClose((_HANDLE)Handle_4);
          if( v21 >= 0 )
            v21 = v15;
          v15 = v21;
        }
        ++v16;
      }
      LODWORD(Lengthb) = 1024;
    }
    ZwClose((_HANDLE)KeyHandle);
    if( v18 != -2147483622 )
      return v15;
    return v3;
  }
  return result;
}

Referenced by: