RegRtlEnumKey

__int64 __fastcall RegRtlEnumKey(HANDLE KeyHandle, UINT64 a2, char *a3, unsigned int *a4){
  unsigned int *v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  char *p_KeyInformation; 
  NTSTATUS v11; 
  unsigned int v12; 
  unsigned int *v13; 
  unsigned int v14; 
  unsigned int v15; 
  unsigned int *PoolWithTag; 
  NTSTATUS v18; 
  unsigned int v19; 
  unsigned int v20; 
  UINT64 Length; 
  UINT64 Lengtha; 
  UINT64 ResultLength; 
  char KeyInformation; 
  HIDWORD(ResultLength) = a2;
  LODWORD(ResultLength) = 0;
  v7 = 0i64;
  if( a3 )
  {
    v8 = 2i64 * *a4;
    if( v8 > 0xFFFFFFFF )
      return(unsigned int)-1073741675;
  }
  else
  {
    LODWORD(v8) = 0;
  }
  v9 = 96;
  if( (unsigned int)v8 > 0x60 )
  {
    p_KeyInformation = a3;
    v9 = v8;
  }
  else
  {
    p_KeyInformation = &KeyInformation;
  }
  LODWORD(Length) = v9;
  v11 = ZwEnumerateKey(KeyHandle, a2, KeyBasicInformation, p_KeyInformation, Length, &ResultLength);
  v12 = v11;
  if( !v11 || v11 == -2147483643 )
  {
    v13 = (unsigned int *)(p_KeyInformation + 12);
    v14 = *((_DWORD *)p_KeyInformation + 3);
    v15 = v14 + 2;
    if( v14 + 2 >= v14 )
    {
      *a4 = v15 >> 1;
      if( v15 > (unsigned int)v8 )
        return(unsigned int)-1073741789;
      if( (unsigned int)ResultLength <= v9 )
        goto LABEL_9;
      if( (unsigned int)v8 < 0xFFFFFFF0 )
      {
        PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(v8 + 16), 0x4C474552ui64);
        v7 = PoolWithTag;
        if( !PoolWithTag )
          return(unsigned int)-1073741801;
        p_KeyInformation = (char *)PoolWithTag;
        LODWORD(Lengtha) = v8 + 16;
        v18 = ZwEnumerateKey(KeyHandle, HIDWORD(ResultLength), KeyBasicInformation, PoolWithTag, Lengtha, &ResultLength);
        v12 = v18;
        if( v18 && v18 != -2147483643 )
          goto LABEL_10;
        v13 = v7 + 3;
        v19 = v7[3];
        v20 = v19 + 2;
        if( v19 + 2 < v19 )
        {
          v12 = -1073741675;
        }
        else
        {
          *a4 = v20 >> 1;
          if( v20 <= (unsigned int)v8 )
          {
LABEL_9:
            memmove((UINT8 *)a3, (UINT8 *)p_KeyInformation + 16, *v13);
            v12 = 0;
            *(_WORD *)&a3[2 * *a4 - 2] = 0;
            goto LABEL_10;
          }
          v12 = -1073741789;
        }
LABEL_10:
        if( v7 )
          ExFreePoolWithTag(v7, 0);
        return v12;
      }
    }
    return(unsigned int)-1073741675;
  }
  return v12;
}

Referenced by: