SdbpCheckMatchingRegistryValue

INT64 __fastcall SdbpCheckMatchingRegistryValue(
        HANDLE KeyHandle,
        WCHAR *Source,
        INT64 a3,
        WCHAR *a4,
        INT64 a5,
        INT64 a6,
        PVOID buf1,
        UINT64 count,
        INT64 a9){
  int v9; 
  WCHAR *v12; 
  WCHAR *v13; 
  _DWORD *v14; 
  unsigned int v15; 
  WCHAR v16; 
  const WCHAR *v17; 
  int v18; 
  NTSTATUS v19; 
  VOID *v20; 
  INT64 v21; 
  _DWORD *v22; 
  VOID *v23; 
  INT64 v24; 
  const CHAR *v25; 
  UINT64 v26; 
  unsigned int v27; 
  UINT8 *v28; 
  bool v29; 
  UINT8 *v31; 
  WCHAR *v32; 
  UINT8 *v33; 
  PCWSTR SourceString; 
  struct _UNICODE_STRING DestinationString; 
  ULONG ResultLength; 
  PWCHAR Pattern; 
  Pattern = a4;
  SourceString = 0i64;
  v9 = a3;
  ResultLength = 0;
  v12 = 0i64;
  v13 = 0i64;
  v14 = 0i64;
  v15 = 0;
  DestinationString = 0i64;
  if( !Source || !*Source )
    goto LABEL_28;
  if( wcsicmp(Source, L"dbRegistryDefaultName") )
  {
    v18 = AslStringDuplicate((WCHAR **)&SourceString, Source);
    v12 = (WCHAR *)SourceString;
    if( v18 < 0 )
      goto LABEL_34;
    v17 = SourceString;
  }
  else
  {
    v17 = 0i64;
  }
  RtlInitUnicodeString(&DestinationString, v17, v16);
  v19 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValueFullInformation, 0i64, 0, &ResultLength);
  if( v19 < 0 && v19 != -2147483643 && v19 != -1073741789 )
  {
    v15 = 1;
    goto LABEL_34;
  }
  v22 = AslAlloc(v20, ResultLength, v21);
  v14 = v22;
  if( !v22 )
  {
    AslLogCallPrintf(1ui64, "SdbpCheckMatchingRegistryValue", 0x3C8ui64, "Failed to allocate memory");
    goto LABEL_34;
  }
  if( ZwQueryValueKey(KeyHandle, &DestinationString, KeyValueFullInformation, v22, ResultLength, &ResultLength) >= 0 )
  {
    v27 = v14[1];
    if( !v9 )
    {
      *(_DWORD *)a9 = 1;
LABEL_18:
      v15 = 1;
      goto LABEL_30;
    }
    if( v27 != v9 )
      goto LABEL_18;
    v28 = (UINT8 *)v14 + (unsigned int)v14[2];
    if( !v27 )
      goto LABEL_53;
    if( v27 > 2 )
    {
      switch( v27 )
      {
        case 3u:
          if( count != v14[3] )
            goto LABEL_29;
          v29 = memcmp(buf1, (char *)v14 + (unsigned int)v14[2], count) == 0;
          break;
        case 4u:
          v29 = (_DWORD)a5 == *(_DWORD *)v28;
          break;
        case 7u:
          v31 = (UINT8 *)AslAlloc(v23, (unsigned int)v14[3] + 2i64, v24);
          v13 = (WCHAR *)v31;
          if( !v31 )
          {
            v26 = 1039i64;
LABEL_51:
            v25 = "Failed to allocate memory";
            goto LABEL_15;
          }
          memmove(v31, v28, (unsigned int)v14[3]);
          v32 = v13;
          for( v13[(unsigned __int64)(unsigned int)v14[3] >> 1] = 0;
                v32 < (WCHAR *)((char *)v13 + (v14[3] & 0xFFFFFFFE));
                ++v32 )
          {
            if( !*v32 )
            {
              if( !v32[1] )
                goto LABEL_44;
              *v32 = 59;
            }
          }
          goto LABEL_44;
        case 0xBu:
          v29 = a6 == *(_QWORD *)v28;
          break;
        default:
LABEL_53:
          v25 = "Unknown registry value data type";
          v26 = 1114i64;
          goto LABEL_15;
      }
      if( !v29 )
      {
LABEL_29:
        v15 = 1;
        goto LABEL_30;
      }
LABEL_28:
      *(_DWORD *)a9 = 1;
      goto LABEL_29;
    }
    v33 = (UINT8 *)AslAlloc(v23, (unsigned int)v14[3] + 2i64, v24);
    v13 = (WCHAR *)v33;
    if( !v33 )
    {
      v26 = 1016i64;
      goto LABEL_51;
    }
    memmove(v33, v28, (unsigned int)v14[3]);
    v13[(unsigned __int64)(unsigned int)v14[3] >> 1] = 0;
LABEL_44:
    if( !AslStringPatternMatchW(Pattern, v13) )
      goto LABEL_29;
    goto LABEL_28;
  }
  v25 = "Failed to read value";
  v26 = 979i64;
LABEL_15:
  AslLogCallPrintf(1ui64, "SdbpCheckMatchingRegistryValue", v26, v25);
LABEL_30:
  if( v14 )
    ExFreePoolWithTag(v14, 0x74705041u);
  if( v13 )
    ExFreePoolWithTag(v13, 0x74705041u);
LABEL_34:
  if( v12 )
    ExFreePoolWithTag(v12, 0x74705041u);
  return v15;
}

Referenced by: