RtlpCallQueryRegistryRoutine

NTSTATUS __stdcall RtlpCallQueryRegistryRoutine(
        VOID *Key,
        _RTL_QUERY_REGISTRY_TABLE *QueryTable,
        _KEY_VALUE_FULL_INFORMATION *KeyValueInformation,
        UINT64 *PKeyValueInfoLength,
        VOID *Context,
        VOID *Environment,
        UINT8 ValidateKeyTrust){
  int v7; 
  NTSTATUS v8; 
  ULONG Type; 
  unsigned int DefaultType; 
  VOID *v13; 
  unsigned __int64 v14; 
  ULONG DataOffset; 
  ULONG DataLength; 
  ULONG NameLength; 
  __int64 v18; 
  signed int v19; 
  char *Name; 
  int v21; 
  _WORD *DefaultData; 
  UINT64 Flags; 
  INT64 v24; 
  NTSTATUS v25; 
  NTSTATUS result; 
  _WORD *v27; 
  bool v28; 
  unsigned __int64 v29; 
  int v30; 
  _WORD *i; 
  UINT64 v33; 
  unsigned int v34; 
  NTSTATUS RegistryDirect; 
  ULONG v37; 
  _WORD *v38; 
  VOID *v40; 
  void *EntryContext; 
  INT64 v42; 
  INT64 v43; 

  v7 = *(_DWORD *)PKeyValueInfoLength;
  v8 = 0;
  *(_DWORD *)PKeyValueInfoLength = 0;
  Type = KeyValueInformation->Type;
  DefaultType = QueryTable->DefaultType;
  v13 = Key;
  v14 = (unsigned __int64)KeyValueInformation;
  if( Type )
  {
    DataOffset = KeyValueInformation->DataOffset;
    if( DataOffset != -1 )
    {
      DataLength = *(_DWORD *)(v14 + 12);
      if( DataLength || Type != (unsigned __int8)DefaultType )
      {
        if( (QueryTable->Flags & 0x20) != 0 )
        {
          Name = (char *)QueryTable->Name;
LABEL_10:
          DefaultData = (_WORD *)((char *)KeyValueInformation + DataOffset);
          goto LABEL_11;
        }
        NameLength = KeyValueInformation->NameLength;
        v18 = DataLength + DataOffset;
        if( !DataLength )
          v18 = NameLength + 20;
        v19 = NameLength + 2;
        Name = (char *)(((unsigned __int64)&KeyValueInformation->Type + v18 + 3) & 0xFFFFFFFFFFFFFFF8ui64);
        if( NameLength < 0xFFFFFFFE )
        {
          v21 = (_DWORD)KeyValueInformation + v7;
          if( v21 - (int)Name < v19 )
          {
            result = -1073741789;
            *(_DWORD *)PKeyValueInfoLength = v19 + (_DWORD)Name - (_DWORD)KeyValueInformation;
            return result;
          }
          memmove(Name, KeyValueInformation->Name, NameLength);
          v13 = Key;
          *(_WORD *)&Name[KeyValueInformation->NameLength] = 0;
          Type = KeyValueInformation->Type;
          DataOffset = KeyValueInformation->DataOffset;
          DataLength = KeyValueInformation->DataLength;
          v14 = (unsigned __int64)&Name[v19 + 7] & 0xFFFFFFFFFFFFFFF8ui64;
          v7 = v21 - v14;
          goto LABEL_10;
        }
        return -1073741764;
      }
    }
  }
  if( !(_BYTE)DefaultType )
  {
    v28 = (QueryTable->Flags & 4) == 0;
    goto LABEL_35;
  }
  DataLength = QueryTable->DefaultLength;
  Type = (unsigned __int8)DefaultType;
  Name = (char *)QueryTable->Name;
  DefaultData = QueryTable->DefaultData;
  if( !DataLength )
  {
    v27 = QueryTable->DefaultData;
    if( (unsigned int)(unsigned __int8)DefaultType - 1 <= 1 )
    {
      if( !DefaultData )
        return -1073741764;
      while( *v27++ )
        ;
      DataLength = (_DWORD)v27 - (_DWORD)DefaultData;
    }
    else if( (unsigned __int8)DefaultType == 7 )
    {
      if( !DefaultData )
        return -1073741764;
      if( *DefaultData )
      {
        do
        {
          while( *v27++ )
            ;
        }
        while( *v27 );
      }
      DataLength = (_DWORD)v27 - (_DWORD)DefaultData + 2;
    }
  }
LABEL_11:
  Flags = QueryTable->Flags;
  v24 = QueryTable->Flags & 0x20;
  if( (QueryTable->Flags & 0x20) == 0 )
    goto LABEL_12;
  if( (Flags & 0x100) == 0 )
  {
    if( (Flags & 0x80u) == 0i64 || Type - 1 > 1 && Type != 7 )
      goto LABEL_12;
    v28 = (Flags & 4) == 0;
LABEL_35:
    if( v28 )
      return 0;
    else
      return -1073741772;
  }
  if( HIBYTE(QueryTable->DefaultType) != Type )
    return -1073741788;
LABEL_12:
  if( (Flags & 0x10) == 0 )
  {
    if( Type == 7 )
    {
      v29 = (unsigned __int64)DefaultData + DataLength - 4;
      v30 = 0;
      for( i = DefaultData; (unsigned __int64)i < v29; DefaultData = i )
      {
        while( *i++ )
          ;
        v33 = QueryTable->Flags;
        v34 = (_DWORD)i - (_DWORD)DefaultData;
        if( (v33 & 0x20) != 0 )
        {
          if( ValidateKeyTrust )
          {
            v30 = RtlpValidateKeyTrust(
                    v13,
                    v33,
                    v24,
                    (INT64)PKeyValueInfoLength,
                    (INT64)v40,
                    (INT64)EntryContext,
                    v42,
                    v43);
            if( v30 < 0 )
              return v30;
          }
          RegistryDirect = RtlpQueryRegistryDirect(1ui64, DefaultData, v34, QueryTable->EntryContext);
          QueryTable->EntryContext = (char *)QueryTable->EntryContext + 16;
        }
        else
        {
          EntryContext = QueryTable->EntryContext;
          v40 = Context;
          RegistryDirect = ((__int64(__fastcall *)(char *, __int64, _WORD *, _QWORD))QueryTable->QueryRoutine)(
                             Name,
                             1i64,
                             DefaultData,
                             v34);
        }
        v30 = 0;
        if( RegistryDirect != -1073741789 )
          v30 = RegistryDirect;
        if( v30 < 0 )
          break;
        v13 = Key;
      }
      return v30;
    }
    if( Type == 2 )
    {
      v37 = DataLength - 2;
      if( DataLength - 2 <= 0xFFFA )
      {
        v38 = DefaultData;
        if( DataLength != 2 )
        {
          while( *v38 != 37 )
          {
            ++v38;
            v37 -= 2;
            if( !v37 )
              goto LABEL_15;
          }
          if( v7 > 0 )
          {
            if( (unsigned __int64)v7 > 0xFFFE )
              *(_WORD *)(v14 + 65532) = 0;
            else
              *(_WORD *)(v14 + 2 * ((unsigned __int64)v7 >> 1) - 2) = 0;
          }
          return -1073741811;
        }
      }
    }
  }
LABEL_15:
  if( (_DWORD)v24 )
  {
    if( ValidateKeyTrust )
    {
      result = RtlpValidateKeyTrust(
                 v13,
                 Flags,
                 v24,
                 (INT64)PKeyValueInfoLength,
                 (INT64)v40,
                 (INT64)EntryContext,
                 v42,
                 v43);
      if( result < 0 )
        return result;
    }
    v25 = RtlpQueryRegistryDirect(Type, DefaultData, DataLength, QueryTable->EntryContext);
  }
  else
  {
    v25 = QueryTable->QueryRoutine(Name, Type, DefaultData, DataLength, Context, QueryTable->EntryContext);
  }
  if( v25 != -1073741789 )
    return v25;
  return v8;
}

Referenced by: