RtlpOpenImageFileOptionsKeyEx

NTSTATUS __fastcall RtlpOpenImageFileOptionsKeyEx(UINT16 *a1, INT64 a2, INT64 a3, PVOID *a4){
  unsigned int v4; 
  __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  bool v9; 
  NTSTATUS result; 
  HANDLE v11; 
  unsigned int v12; 
  bool v13; 
  UNICODE_STRING *v14; 
  int v15; 
  void *KeyHandle; 
  __int128 i; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  HANDLE v19; 
  HANDLE Handle; 
  *a4 = 0i64;
  v4 = *a1;
  Handle = 0i64;
  v6 = *((_QWORD *)a1 + 1) + v4;
  KeyHandle = 0i64;
  v7 = v4;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  for( i = 0i64; v7; v7 -= 2 )
  {
    if( *(_WORD *)(v6 - 2) == 92 )
      break;
    v6 -= 2i64;
  }
  v8 = v4 - v7;
  *((_QWORD *)&i + 1) = v6;
  LOWORD(i) = v8;
  if( (unsigned __int16)v8 != v8 )
    return -1073741789;
  v9 = RtlpDisableIFEOCaching != 0;
  result = RtlpOpenBaseImageFileOptionsKey(&Handle);
  if( result >= 0 )
  {
    v11 = Handle;
    v12 = 1600;
    v13 = *((_BYTE *)KeGetCurrentThread() + 562) == 1;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = Handle;
    if( !v13 )
      v12 = 576;
    ObjectAttributes.Attributes = v12;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&i;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v15 = ZwOpenKey(&KeyHandle, 9u, &ObjectAttributes);
    if( v9 )
      ZwClose(v11);
    if( v15 >= 0 )
    {
      v19 = KeyHandle;
      v15 = RtlpProcessIFEOKeyFilter(&v19, v14);
      if( v15 < 0 )
      {
        if( v19 )
          ZwClose(v19);
      }
      else
      {
        *a4 = v19;
      }
    }
    return v15;
  }
  return result;
}

Referenced by: