NtQueryOpenSubKeys

__int64 __fastcall NtQueryOpenSubKeys(_OBJECT_ATTRIBUTES *ObjectAttributes, _DWORD *a2){
  char v4; 
  BOOL v5; 
  int v6; 
  char PreviousMode; 
  __int64 v8; 
  int v9; 
  VOID *ProbeMode; 
  _KAPC_STATE ApcState; 
  VOID *Object[38]; 

  memset(&ApcState, 0, sizeof(ApcState));
  memset(Object, 0i64, 0x128u);
  LODWORD(Object[12]) = -1;
  Object[19] = &Object[18];
  Object[18] = &Object[18];
  memset(&Object[27], 0i64, 0x50u);
  v4 = 0;
  v5 = CmpAcquireShutdownRundown();
  if( v5 )
  {
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    if( PreviousMode == 1 )
    {
      v8 = (__int64)a2;
      if( (unsigned __int64)a2 >= 0x7FFFFFFF0000i64 )
        v8 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v8 = *(_DWORD *)v8;
    }
    LOBYTE(ProbeMode) = PreviousMode;
    v6 = ObReferenceObjectByNameEx(
           ObjectAttributes,
           0i64,
           (_OBJECT_TYPE *)0x20019,
           (CHAR)CmKeyObjectType,
           ProbeMode,
           Object);
    if( v6 >= 0 )
    {
      CmpLockRegistryExclusive();
      v4 = 1;
      v6 = CmpPerformKeyBodyDeletionCheck(0i64, 0i64);
      if( v6 >= 0 )
      {
        if( (*(_DWORD *)(MEMORY[8] + 184i64) & 0x40000) != 0 )
        {
          CmpAttachToRegistryProcess(&ApcState);
          v9 = CmpSearchForOpenSubKeys(MEMORY[8], 0, 0i64);
          CmpDetachFromRegistryProcess(&ApcState);
          CmpUnlockRegistry();
          v4 = 0;
          *a2 = v9;
          v6 = 0;
        }
        else
        {
          v6 = -1073741811;
        }
      }
    }
  }
  else
  {
    v6 = -1073741431;
  }
  if( v4 )
    CmpUnlockRegistry();
  CmpCleanupParseContext((INT64)Object, 0);
  if( v5 )
    CmpReleaseShutdownRundown();
  return(unsigned int)v6;
}

Referenced by: