NtOpenKeyTransactedEx

NTSTATUS __stdcall NtOpenKeyTransactedEx(
        PVOID *KeyHandle,
        UINT64 DesiredAccess,
        OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 OpenOptions,
        PVOID TransactionHandle){
  _ETHREAD *CurrentThread; 
  unsigned int v6; 
  unsigned int v8; 
  bool v10; 
  _ETHREAD *v11; 
  KPROCESSOR_MODE v12; 
  NTSTATUS v13; 
  INT64 v14; 
  NTSTATUS v15; 
  NTSTATUS v16; 
  INT64 v18; 
  PVOID Object; 
  PVOID v20; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = OpenOptions;
  v8 = DesiredAccess;
  --*((_WORD *)CurrentThread + 242);
  v10 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  v11 = (_ETHREAD *)KeGetCurrentThread();
  if( !v10 )
  {
    KeLeaveCriticalRegionThread((__int64)v11);
    return -1073741431;
  }
  v12 = *((_BYTE *)v11 + 562);
  Object = 0i64;
  v13 = ObReferenceObjectByHandle(TransactionHandle, 4u, CmRegistryTransactionType, v12, &Object, 0i64);
  v14 = (INT64)Object;
  v15 = v13;
  if( v13 == -1073741788 )
  {
    v20 = 0i64;
    v16 = ObReferenceObjectByHandle(
            TransactionHandle,
            4u,
            (POBJECT_TYPE)TmTransactionObjectType,
            *((_BYTE *)KeGetCurrentThread() + 562),
            &v20,
            0i64);
    v14 = (INT64)v20;
    v15 = v16;
    goto LABEL_4;
  }
  if( v13 >= 0 )
  {
    v14 = (unsigned __int64)Object | 1;
LABEL_4:
    if( v15 >= 0 )
      v15 = CmOpenKey(KeyHandle, v8, ObjectAttributes, v6, (_CM_TRANS_PTR)v14, v18, (INT64)Object, (INT64)v20);
  }
  if( v14 )
    CmpTransDereferenceTransaction(v14);
  ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v15;
}

Referenced by: