SysCtxOpenMachine

__int64 __fastcall SysCtxOpenMachine(
        __int64 a1,
        __int64 a2,
        __int64 a3,
        __int64 a4,
        HANDLE SourceHandle,
        int a6,
        __int64 a7){
  int Version; 
  _OWORD *PoolWithTag; 
  __int64 v11; 
  _BYTE *v12; 
  int v13; 
  const WCHAR *v14; 
  __int64 v15; 
  __int64 v16; 
  void *v17; 
  UINT64 DesiredAccess; 
  UINT64 HandleAttributes; 
  UINT64 Options; 
  void *TargetHandle; 
  HANDLE Handle; 
  HANDLE v24; 
  HANDLE v25; 
  HANDLE v26; 
  struct _OSVERSIONINFOW VersionInformation; 
  unsigned __int8 v28; 
  unsigned __int8 v29; 
  Handle = 0i64;
  v26 = 0i64;
  v24 = 0i64;
  v25 = 0i64;
  Version = 0;
  TargetHandle = 0i64;
  *(_QWORD *)a7 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x38ui64, 0x53504E50ui64);
  v12 = PoolWithTag;
  if( !PoolWithTag )
  {
    Version = -1073741801;
    goto LABEL_27;
  }
  v13 = a6;
  *PoolWithTag = 0i64;
  PoolWithTag[1] = 0i64;
  PoolWithTag[2] = 0i64;
  *((_QWORD *)PoolWithTag + 6) = 0i64;
  if( !a6 )
  {
    memset((INT64)&VersionInformation.dwMajorVersion, 0i64);
    VersionInformation.dwOSVersionInfoSize = 284;
    Version = RtlGetVersion(&VersionInformation);
    if( Version < 0 )
      goto LABEL_27;
    v11 = v28;
    LOWORD(v11) = v28 << 8;
    v13 = v29 | (unsigned __int16)v11 | ((LOBYTE(VersionInformation.dwMinorVersion) | (unsigned __int16)(LOBYTE(VersionInformation.dwMajorVersion) << 8)) << 16);
  }
  *(_DWORD *)v12 = v13;
  if( SourceHandle )
  {
    LODWORD(Options) = 2;
    LODWORD(HandleAttributes) = 0;
    LODWORD(DesiredAccess) = 0;
    Version = ZwDuplicateObject(
                (PVOID)0xFFFFFFFFFFFFFFFFi64,
                SourceHandle,
                (PVOID)0xFFFFFFFFFFFFFFFFi64,
                &TargetHandle,
                DesiredAccess,
                HandleAttributes,
                Options);
    if( Version < 0 )
    {
      TargetHandle = 0i64;
      goto LABEL_15;
    }
  }
  if( !a2 )
  {
    v14 = L"SYSTEM";
    v15 = 2147483650i64;
    goto LABEL_6;
  }
  if( a2 != -1 )
  {
    v14 = 0i64;
    v15 = a2;
LABEL_6:
    Version = RegRtlOpenKeyTransacted((char *)v15, v14, 0, 0x2000000u, &Handle, (__int64)TargetHandle);
    if( Version )
      goto LABEL_27;
  }
  if( !Handle || (Version = SysCtxOpenControlSet(v11, (char *)Handle, (__int64)TargetHandle, &v25)) == 0 )
  {
    if( a4 )
    {
      if( a4 == -1 )
        goto LABEL_12;
      v16 = a4;
    }
    else
    {
      v16 = 2147483651i64;
    }
    Version = RegRtlOpenKeyTransacted((char *)v16, 0i64, 0, 0x2000000u, &v24, (__int64)TargetHandle);
    if( !Version )
    {
LABEL_12:
      v12[16] = 1;
      v17 = 0i64;
      *((_QWORD *)v12 + 1) = TargetHandle;
      *((_QWORD *)v12 + 3) = Handle;
      *((_QWORD *)v12 + 4) = v26;
      *((_QWORD *)v12 + 6) = v25;
      *((_QWORD *)v12 + 5) = v24;
      *(_QWORD *)a7 = v12;
      v12 = 0i64;
      TargetHandle = 0i64;
      Handle = 0i64;
      v25 = 0i64;
      v24 = 0i64;
      goto LABEL_13;
    }
  }
LABEL_27:
  v17 = TargetHandle;
LABEL_13:
  if( v17 )
    ZwClose(v17);
LABEL_15:
  if( Handle )
    ZwClose(Handle);
  if( v26 )
    ZwClose(v26);
  if( v25 )
    ZwClose(v25);
  if( v24 )
    ZwClose(v24);
  if( v12 )
    ExFreePoolWithTag(v12, 0);
  return(unsigned int)Version;
}

Referenced by: