SysCtxOpenControlSet
__int64 __fastcall SysCtxOpenControlSet(__int64 a1, char *a2, __int64 a3, void **a4){
char v7;
unsigned int KeyTransacted;
unsigned int v10;
int v11;
int v12[4];
int v13;
_DWORD KeyHandle[3];
wchar_t pszDest[16];
*a4 = 0i64;
v12[0] = 0;
*(_QWORD *)&KeyHandle[1] = 0i64;
v13 = 0;
v7 = 0;
KeyTransacted = RegRtlOpenKeyTransacted(a2, L"CurrentControlSet", 0, 0x2000000u, a4, a3);
if( KeyTransacted == -1073741772 )
{
KeyTransacted = RegRtlOpenKeyTransacted(a2, L"Select", 0, 1u, (PHANDLE)&KeyHandle[1], a3);
if( KeyTransacted == -1073741772 )
KeyTransacted = RegRtlCreateKeyTransacted(
(__int64)a2,
L"Select",
0,
3u,
0i64,
0,
(PHANDLE)&KeyHandle[1],
0i64,
a3);
if( !KeyTransacted )
{
KeyHandle[0] = 4;
v10 = RegRtlQueryValue(*(HANDLE *)&KeyHandle[1], L"Current", &v13, v12, (__int64)KeyHandle);
KeyTransacted = v10;
if( v10 == -1073741772 )
{
v12[0] = 1;
v7 = 1;
KeyTransacted = RegRtlSetValue(*(HANDLE *)&KeyHandle[1], L"Current", 4u, v12, 4u);
if( KeyTransacted )
goto LABEL_2;
}
else
{
if( v10 )
goto LABEL_2;
if( v13 != 4 || KeyHandle[0] != 4 )
goto LABEL_19;
}
if( v12[0] <= 0x3E7u )
{
RtlStringCchPrintfW(pszDest, 0xEui64, (WCHAR *)L"ControlSet%03d");
if( v11 >= 0 )
{
KeyTransacted = RegRtlOpenKeyTransacted(a2, pszDest, 0, 0x2000000u, a4, a3);
if( KeyTransacted == -1073741772 && v7 )
KeyTransacted = RegRtlCreateKeyTransacted((__int64)a2, pszDest, 0, 0x2000000u, 0i64, 0, a4, 0i64, a3);
goto LABEL_2;
}
}
LABEL_19:
KeyTransacted = -1073741811;
}
}
LABEL_2:
if( *(_QWORD *)&KeyHandle[1] )
ZwClose(*(HANDLE *)&KeyHandle[1]);
return KeyTransacted;
}Referenced by:
SysCtxOpenMachine