RtlpProcessIFEOKeyFilter

NTSTATUS __stdcall RtlpProcessIFEOKeyFilter(
        VOID **KeyHandle,
        _UNICODE_STRING *ImagePathName,
        const _UNICODE_STRING *a3){
  NTSTATUS v3; 
  VOID **v4; 
  void *v5; 
  char *v7; 
  NTSTATUS result; 
  unsigned int v9; 
  bool v10; 
  char *v11; 
  unsigned int v12; 
  int inited; 
  INT64 v14; 
  int v15; 
  NTSTATUS v16; 
  VOID *PoolWithQuotaTag; 
  int v18; 
  UINT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 NumberOfBytes; 
  VOID *KeyHandlea; 
  int v24; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING String2; 
  unsigned int v27; 
  char *v28; 
  _UNICODE_STRING v29; 
  VOID **v30; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v33; 
  int v34; 
  int v35; 

  v30 = KeyHandle;
  v3 = 0;
  v4 = KeyHandle;
  NumberOfBytes = 0x22000000000i64;
  KeyHandlea = 0i64;
  DestinationString = 0i64;
  v5 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v7 = KeyValueInformation;
  v29 = 0i64;
  result = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"UseFilter");
  if( result < 0 )
    return result;
  LODWORD(Length) = 544;
  result = ZwQueryValueKey(
             *v4,
             &DestinationString,
             KeyValuePartialInformation,
             KeyValueInformation,
             Length,
             &NumberOfBytes);
  if( result < 0 )
  {
    if( result == -1073741772 || result == -1073741789 || result == -2147483643 )
      return v3;
    return result;
  }
  if( v33 != 4 || v34 != 4 || !v35 )
    return 0;
  v9 = 1600;
  v10 = KeGetCurrentThread()->PreviousMode == 1;
  String2 = *a3;
  if( !v10 )
    v9 = 576;
  v27 = v9;
  result = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"\\??\\");
  if( result >= 0 )
  {
    if( (unsigned __int8)RtlPrefixUnicodeString(&DestinationString, &String2, 1u) )
    {
      String2.Length -= 8;
      String2.MaximumLength -= 8;
      String2.Buffer += 4;
    }
    v11 = KeyValueInformation;
    v24 = 0;
    v28 = KeyValueInformation;
    v12 = 0;
    while( 1 )
    {
      LODWORD(Lengtha) = HIDWORD(NumberOfBytes);
      inited = ZwEnumerateKey(*v4, v12, KeyBasicInformation, v11, Lengtha, &NumberOfBytes);
      if( inited >= 0 )
      {
        DestinationString.Length = *((_WORD *)v28 + 6);
        DestinationString.MaximumLength = *((_WORD *)v28 + 6);
        DestinationString.Buffer = (wchar_t *)(v28 + 16);
        ObjectAttributes.RootDirectory = *v4;
        ObjectAttributes.Attributes = v27;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Length = 48;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        inited = ZwOpenKey(
                   &KeyHandlea,
                   9ui64,
                   &ObjectAttributes,
                   v14,
                   Lengtha,
                   (INT64)ResultLength,
                   NumberOfBytes,
                   (INT64)KeyHandlea);
        if( inited >= 0 )
        {
          inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"FilterFullPath");
          if( inited >= 0 )
          {
            v15 = HIDWORD(NumberOfBytes);
            do
            {
              LODWORD(Lengtha) = v15;
              v16 = ZwQueryValueKey(
                      KeyHandlea,
                      &DestinationString,
                      KeyValuePartialInformation,
                      v7,
                      Lengtha,
                      &NumberOfBytes);
              inited = v16;
              if( v16 == -2147483643 || v16 == -1073741789 )
              {
                if( v5 )
                  ExFreePoolWithTag(v5, 0);
                PoolWithQuotaTag = ExAllocatePoolWithQuotaTag(
                                     (POOL_TYPE)520,
                                     (unsigned int)NumberOfBytes,
                                     0x6B497452ui64);
                v5 = PoolWithQuotaTag;
                if( PoolWithQuotaTag )
                {
                  v15 = NumberOfBytes;
                  v7 = (char *)PoolWithQuotaTag;
                  v28 = (char *)PoolWithQuotaTag;
                }
                else
                {
                  inited = -1073741801;
                }
              }
            }
            while( inited == -2147483643 || inited == -1073741789 );
            HIDWORD(NumberOfBytes) = v15;
            v4 = v30;
            if( inited < 0 )
            {
              ZwClose((_HANDLE)KeyHandlea);
              v18 = 0;
              if( inited != -1073741772 )
                v18 = inited;
              inited = v18;
              goto LABEL_39;
            }
            if( *((_DWORD *)v7 + 1) == 1 && *((_DWORD *)v7 + 2) <= 0xFFFEu )
            {
              v29.Length = *((_WORD *)v7 + 4) - 2;
              v29.MaximumLength = v29.Length;
              v29.Buffer = (wchar_t *)(v7 + 12);
              if( !RtlCompareUnicodeString(&String2, &v29, 1u) )
              {
LABEL_40:
                if( v5 )
                  ExFreePoolWithTag(v5, 0);
                if( inited >= 0 )
                {
                  ZwClose((_HANDLE)*v4);
                  *v4 = KeyHandlea;
                }
                if( inited != -2147483622 )
                  return inited;
                return v3;
              }
            }
          }
          ZwClose((_HANDLE)KeyHandlea);
        }
      }
LABEL_39:
      v11 = v28;
      v12 = ++v24;
      if( inited < 0 )
        goto LABEL_40;
    }
  }
  return result;
}

Referenced by: