PiDqOpenUserObjectRegKey

NTSTATUS __stdcall PiDqOpenUserObjectRegKey(
        WCHAR *ObjectName,
        PNP_OBJECT_TYPE ObjectType,
        UINT64 DesiredAccess,
        UINT8 Create,
        _SECURITY_SUBJECT_CONTEXT *SecurityContext,
        VOID **BaseKeyHandle,
        UINT64 *Disposition,
        UINT64 Flags){
  bool v8; 
  WCHAR *v11; 
  WCHAR *v12; 
  __int64 v13; 
  NTSTATUS RelativeObjectRegPath; 
  bool v15; 
  bool v16; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  _SECURITY_SUBJECT_CONTEXT *v18; 
  VOID *PrimaryToken; 
  NTSTATUS v20; 
  __int64 v21; 
  __int64 v22; 
  NTSTATUS Tree; 
  UINT64 v25; 
  INT64 v27; 
  WCHAR *RegPath; 
  VOID *Handle; 
  PNP_OBJECT_TYPE ObjectTypea; 
  const WCHAR *v31; 
  VOID *TokenInformation; 
  WCHAR *ObjectNamea; 
  _UNICODE_STRING UnicodeString; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  char UserSid[80]; 

  v8 = 0;
  HIDWORD(v27) = DesiredAccess;
  ObjectTypea = ObjectType;
  ObjectNamea = ObjectName;
  TokenInformation = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v11 = 0i64;
  v31 = 0i64;
  Handle = 0i64;
  v12 = 0i64;
  UnicodeString = 0i64;
  RegPath = 0i64;
  LODWORD(v27) = 0;
  memset(UserSid, 0i64, 0x44u);
  *BaseKeyHandle = 0i64;
  RelativeObjectRegPath = PnpValidateObjectName(v13, (INT64)ObjectName, ObjectType);
  if( RelativeObjectRegPath >= 0 )
  {
    v15 = SecurityContext == 0i64;
    if( !SecurityContext )
    {
      SeCaptureSubjectContext((INT64)&SubjectContext);
      v15 = 1;
    }
    v16 = v15;
    p_SubjectContext = &SubjectContext;
    if( SecurityContext )
      p_SubjectContext = SecurityContext;
    v15 = p_SubjectContext->ClientToken == 0i64;
    v18 = &SubjectContext;
    if( v15 )
    {
      if( SecurityContext )
        v18 = SecurityContext;
      PrimaryToken = v18->PrimaryToken;
    }
    else
    {
      if( SecurityContext )
        v18 = SecurityContext;
      PrimaryToken = v18->ClientToken;
    }
    v20 = SeQueryInformationToken(PrimaryToken, TokenImpersonationLevel, &TokenInformation);
    RelativeObjectRegPath = v20;
    if( v20 >= 0 )
    {
      if( *(int *)TokenInformation < 2 )
      {
        RelativeObjectRegPath = -1073741790;
        v8 = v16;
        goto LABEL_28;
      }
      goto LABEL_12;
    }
    v8 = v16;
    if( v20 == -1073741821 )
    {
LABEL_12:
      SeQueryUserSidToken(PrimaryToken, UserSid, 0x44ui64, 0i64);
      RelativeObjectRegPath = RtlConvertSidToUnicodeString(&UnicodeString, UserSid, 1u);
      v8 = v16;
      if( RelativeObjectRegPath >= 0 )
      {
        RelativeObjectRegPath = PnpConcatPWSTR(0x7FFFFFFFui64, 0x58706E50u, (PVOID *)&v31, 2ui64);
        if( RelativeObjectRegPath < 0 )
        {
          v11 = (WCHAR *)v31;
        }
        else
        {
          if( *(&stru_140CF2E80 + 607) )
            v21 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64);
          else
            v21 = 0i64;
          v11 = (WCHAR *)v31;
          RelativeObjectRegPath = SysCtxRegOpenKey(v21, 0i64, v31, 0, 4u, &Handle);
          if( RelativeObjectRegPath >= 0 )
          {
            RelativeObjectRegPath = PiDqGetRelativeObjectRegPath(ObjectNamea, ObjectTypea, &RegPath);
            if( RelativeObjectRegPath < 0 )
            {
              v12 = RegPath;
            }
            else
            {
              if( Create )
              {
                v12 = RegPath;
                LODWORD(v25) = HIDWORD(v27);
                Tree = PnpCtxRegCreateTree(
                         *(&stru_140CF2E80 + 607),
                         Handle,
                         RegPath,
                         0i64,
                         v25,
                         0i64,
                         BaseKeyHandle,
                         (UINT64 *)&v27);
              }
              else
              {
                LODWORD(v27) = 2;
                if( *(&stru_140CF2E80 + 607) )
                  v22 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64);
                else
                  v22 = 0i64;
                v12 = RegPath;
                Tree = SysCtxRegOpenKey(v22, Handle, RegPath, 0, HIDWORD(v27), BaseKeyHandle);
              }
              RelativeObjectRegPath = Tree;
              v8 = v16;
              if( Tree >= 0 )
                v8 = v16;
            }
          }
        }
      }
    }
  }
  if( RelativeObjectRegPath == -1073741444 )
    RelativeObjectRegPath = -1073741772;
  if( v12 )
    ExFreePoolWithTag(v12, 0x58706E50u);
LABEL_28:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( v11 )
    ExFreePoolWithTag(v11, 0x58706E50u);
  RtlFreeAnsiString(&UnicodeString);
  if( v8 )
    SeReleaseSubjectContext(&SubjectContext);
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  return RelativeObjectRegPath;
}

Referenced by: