RegRtlCreateTreeTransacted
__int64 __fastcall RegRtlCreateTreeTransacted(
HANDLE Handle,
NTSTRSAFE_PCWSTR pszSrc,
ULONG a3,
ACCESS_MASK a4,
__int64 a5,
char a6,
__int64 a7,
__int64 a8,
__int64 a9){
int KeyTransacted;
UINT64 v14;
WCHAR *PoolWithTag;
wchar_t *v16;
unsigned __int64 v17;
__int64 v18;
const WCHAR *v19;
WCHAR *v20;
ACCESS_MASK v21;
char v22;
ULONG *v23;
void *v24;
ULONG v25;
UINT64 dwFlags;
__int64 v27;
size_t pcchLength;
pcchLength = 0i64;
v27 = 0i64;
KeyTransacted = RegRtlCreateKeyTransacted(
(__int64)Handle,
pszSrc,
a3,
a4,
(void *)a5,
a6,
(PHANDLE)a7,
(PULONG)a8,
a9);
if( KeyTransacted == -1073741772 )
{
KeyTransacted = RtlUnalignedStringCchLengthW(pszSrc, 0x7FFFui64, &pcchLength);
if( KeyTransacted >= 0 )
{
v14 = pcchLength + 1;
PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 2 * (pcchLength + 1), 0x4C474552ui64);
v16 = PoolWithTag;
if( PoolWithTag )
{
LODWORD(dwFlags) = 256;
KeyTransacted = RtlStringCchCopyExW(PoolWithTag, v14, (WCHAR *)pszSrc, 0i64, 0i64, dwFlags);
if( !KeyTransacted )
{
v17 = (unsigned __int64)v16;
v18 = (__int64)Handle;
if( !Handle && !wcsnicmp(v16, L"\\REGISTRY\\MACHINE\\", 0x12ui64) )
{
v18 = 2147483650i64;
v17 = (unsigned __int64)(v16 + 18);
}
while( 1 )
{
v19 = (const WCHAR *)v17;
v20 = wcschr((WCHAR *)v17, 0x5Cu);
v17 = (unsigned __int64)v20;
if( v20 )
{
*v20 = 0;
do
v17 += 2i64;
while( *(_WORD *)v17 == 92 );
v17 &= -(__int64)(*(_WORD *)v17 != 0);
}
v21 = a4;
v22 = a6;
v23 = (ULONG *)a8;
if( v17 )
v21 = 4;
if( v17 )
v22 = 0;
v24 = (void *)a5;
if( v17 )
v23 = 0i64;
v25 = a3;
if( v17 )
v24 = 0i64;
if( v17 )
v25 = a3 & 0xFFFFFFFC;
KeyTransacted = RegRtlCreateKeyTransacted(v18, v19, v25, v21, v24, v22, (PHANDLE)&v27, v23, a9);
if( (HANDLE)v18 != Handle && v18 != 2147483650i64 )
ZwClose((HANDLE)v18);
if( KeyTransacted )
break;
if( !v17 )
{
*(_QWORD *)a7 = v27;
break;
}
v18 = v27;
}
}
ExFreePoolWithTag(v16, 0);
}
else
{
return(unsigned int)-1073741801;
}
}
}
return(unsigned int)KeyTransacted;
}Referenced by:
SysCtxRegCreateTree