RtlpGetRegistryHandle

NTSTATUS __stdcall RtlpGetRegistryHandle(UINT64 RelativeTo, const WCHAR *KeyName, UINT8 WriteAccess, VOID **Key){
  __int64 v7; 
  struct _KPRCB *CurrentPrcb; 
  _GENERAL_LOOKASIDE *P; 
  wchar_t *v10; 
  int appended; 
  INT64 v12; 
  NTSTATUS v13; 
  struct _KPRCB *v14; 
  _SLIST_ENTRY *Buffer; 
  _GENERAL_LOOKASIDE *v16; 
  _GENERAL_LOOKASIDE *L; 
  __int64 Size; 
  void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *); 
  __int64 Tag; 
  __int64 Type; 
  _UNICODE_STRING *Class; 
  UINT64 CreateOptions; 
  UINT64 *Disposition; 
  INT64 v26; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING CurrentUserKeyPath; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  *(_DWORD *)(&Destination.MaximumLength + 1) = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  CurrentUserKeyPath = 0i64;
  if( (RelativeTo & 0x40000000) != 0 )
  {
    *Key = (VOID *)KeyName;
    return 0;
  }
  else
  {
    v7 = (unsigned int)RelativeTo;
    LODWORD(v7) = RelativeTo & 0x7FFFFFFF;
    if( (RelativeTo & 0x80000000) == 0i64 )
      v7 = (unsigned int)RelativeTo;
    if( (unsigned int)v7 >= 6 )
    {
      return -1073741811;
    }
    else
    {
      CurrentPrcb = KeGetCurrentPrcb();
      P = CurrentPrcb->PPLookasideList[8].P;
      ++P->TotalAllocates;
      v10 = (wchar_t *)RtlpInterlockedPopEntrySList(&P->ListHead);
      if( v10 )
        goto LABEL_6;
      ++P->AllocateMisses;
      L = CurrentPrcb->PPLookasideList[8].L;
      ++L->TotalAllocates;
      v10 = (wchar_t *)RtlpInterlockedPopEntrySList(&L->ListHead);
      if( v10
        || (Size = L->Size,
            AllocateEx = L->AllocateEx,
            Tag = L->Tag,
            Type = (unsigned int)L->Type,
            ++L->AllocateMisses,
            (v10 = (wchar_t *)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(Type, Size, Tag)) != 0i64) )
      {
LABEL_6:
        *(_DWORD *)v10 = CurrentPrcb->Number;
      }
      Destination.Buffer = v10;
      if( v10 )
      {
        *(_DWORD *)&Destination.Length = 34340864;
        if( !(_DWORD)v7 )
          goto LABEL_13;
        if( (_DWORD)v7 == 5 && RtlFormatCurrentUserKeyPath(&CurrentUserKeyPath) >= 0 )
        {
          appended = RtlAppendUnicodeStringToString(&Destination, &CurrentUserKeyPath);
          RtlFreeAnsiString(&CurrentUserKeyPath);
        }
        else
        {
          appended = RtlAppendUnicodeToString(&Destination, (WCHAR *)RtlpRegistryPaths[v7]);
        }
        if( appended >= 0 )
        {
          appended = RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\");
          if( appended >= 0 )
          {
LABEL_13:
            appended = RtlAppendUnicodeToString(&Destination, (WCHAR *)KeyName);
            if( appended >= 0 )
            {
              ObjectAttributes.Length = 48;
              ObjectAttributes.ObjectName = &Destination;
              ObjectAttributes.RootDirectory = 0i64;
              ObjectAttributes.Attributes = 576;
              *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
              if( WriteAccess )
              {
                LODWORD(CreateOptions) = 0;
                v13 = ZwCreateKey(Key, 0x40000000ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
              }
              else
              {
                v13 = ZwOpenKey(
                        Key,
                        0x82000000ui64,
                        &ObjectAttributes,
                        v12,
                        (INT64)Class,
                        CreateOptions,
                        (INT64)Disposition,
                        v26);
              }
              appended = v13;
            }
          }
        }
        v14 = KeGetCurrentPrcb();
        Buffer = (_SLIST_ENTRY *)Destination.Buffer;
        v16 = v14->PPLookasideList[8].P;
        ++v16->TotalFrees;
        if( LOWORD(v16->ListHead.Alignment) < v16->Depth
          || (++v16->FreeMisses,
              v16 = v14->PPLookasideList[8].L,
              ++v16->TotalFrees,
              LOWORD(v16->ListHead.Alignment) < v16->Depth) )
        {
          RtlpInterlockedPushEntrySList(&v16->ListHead, Buffer);
        }
        else
        {
          ++v16->FreeMisses;
          ((void(__fastcall *)(_SLIST_ENTRY *))v16->FreeEx)(Buffer);
        }
        return appended;
      }
      else
      {
        return -1073741801;
      }
    }
  }
}

Referenced by: