SysCtxRegOpenCurrentUserKey

__int64 __fastcall SysCtxRegOpenCurrentUserKey(_QWORD *a1, ULONG a2, ACCESS_MASK a3, void **a4){
  wchar_t *v8; 
  int appended; 
  UINT64 v10; 
  void *v11; 
  unsigned __int16 v13; 
  wchar_t *PoolWithTag; 
  __int64 v15; 
  USHORT pusResult[2]; 
  struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  int TokenInformation; 
  ULONG ReturnLength; 
  HANDLE Handle; 
  int v21; 
  struct _UNICODE_STRING Destination; 
  char *v23; 
  struct _UNICODE_STRING UnicodeString; 
  char Sid[16]; 
  void *Sid2[11]; 
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  Handle = 0i64;
  TokenInformation = 0;
  v21 = 0;
  ReturnLength = 0;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  v23 = 0i64;
  *(_DWORD *)(&Destination.MaximumLength + 1) = 0;
  pusResult[0] = 0;
  v8 = 0i64;
  UnicodeString = 0i64;
  appended = ZwOpenThreadTokenEx((PVOID)0xFFFFFFFFFFFFFFFEi64, 8ui64, 0, 0x200ui64, &Handle);
  if( appended == -1073741700 )
    appended = ZwOpenProcessTokenEx((PVOID)0xFFFFFFFFFFFFFFFFi64, 8ui64, 0x200ui64, &Handle);
  if( appended >= 0 )
  {
    appended = ZwQueryInformationToken(Handle, TokenType, &TokenInformation, 4u, &ReturnLength);
    if( appended >= 0 )
    {
      if( TokenInformation == 2 )
      {
        appended = ZwQueryInformationToken(Handle, TokenImpersonationLevel, &v21, 4u, &ReturnLength);
        if( appended < 0 )
          goto LABEL_11;
        if( v21 < 2 )
        {
          appended = -1073741790;
          goto LABEL_11;
        }
      }
      else if( TokenInformation != 1 )
      {
LABEL_10:
        appended = -1073741637;
        goto LABEL_11;
      }
      appended = ZwQueryInformationToken(Handle, TokenUser, Sid2, 0x54u, &ReturnLength);
      if( appended >= 0 )
      {
        v11 = Sid2[0];
        LOBYTE(v10) = 1;
        appended = RtlInitializeSid(Sid, &IdentifierAuthority, v10);
        if( appended >= 0 )
        {
          *RtlSubAuthoritySid(Sid, 0i64) = 18;
          if( RtlEqualSid(Sid, v11) )
            goto LABEL_10;
          appended = RtlConvertSidToUnicodeString(&UnicodeString, v11, 1u);
          if( appended >= 0 )
          {
            appended = RtlUShortAdd(UnicodeString.Length, 0x1Eu, pusResult);
            if( appended >= 0 )
            {
              appended = RtlUShortAdd(pusResult[0], 2u, pusResult);
              if( appended >= 0 )
              {
                v13 = pusResult[0];
                PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, pusResult[0], 0x53504E50ui64);
                v8 = PoolWithTag;
                if( PoolWithTag )
                {
                  Destination.Length = 0;
                  Destination.MaximumLength = v13;
                  Destination.Buffer = PoolWithTag;
                  appended = RtlAppendUnicodeStringToString(&Destination, (UNICODE_STRING *)&stru_1400099A0);
                  if( appended >= 0 )
                  {
                    appended = RtlAppendUnicodeStringToString(&Destination, &UnicodeString);
                    if( appended >= 0 )
                    {
                      appended = SysCtxGetCachedContextBaseKey(a1, 3, &v23);
                      if( appended >= 0 )
                        appended = SysCtxRegOpenKey(v15, v23, (const WCHAR *)Destination.Buffer + 15, a2, a3, a4);
                    }
                  }
                }
                else
                {
                  appended = -1073741801;
                }
              }
            }
          }
        }
      }
    }
  }
LABEL_11:
  if( Handle )
    ZwClose(Handle);
  RtlFreeAnsiString(&UnicodeString);
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  return(unsigned int)appended;
}

Referenced by: