RegRtlCreateTreeTransacted

__int64 __fastcall RegRtlCreateTreeTransacted(
        HANDLE Handle,
        NTSTRSAFE_PCWSTR pszSrc,
        ULONG a3,
        ACCESS_MASK a4,
        __int64 a5,
        char a6,
        __int64 a7,
        __int64 a8,
        __int64 a9){
  int KeyTransacted; 
  UINT64 v14; 
  WCHAR *PoolWithTag; 
  wchar_t *v16; 
  unsigned __int64 v17; 
  __int64 v18; 
  const WCHAR *v19; 
  WCHAR *v20; 
  ACCESS_MASK v21; 
  char v22; 
  ULONG *v23; 
  void *v24; 
  ULONG v25; 
  UINT64 dwFlags; 
  __int64 v27; 
  size_t pcchLength; 
  pcchLength = 0i64;
  v27 = 0i64;
  KeyTransacted = RegRtlCreateKeyTransacted(
                    (__int64)Handle,
                    pszSrc,
                    a3,
                    a4,
                    (void *)a5,
                    a6,
                    (PHANDLE)a7,
                    (PULONG)a8,
                    a9);
  if( KeyTransacted == -1073741772 )
  {
    KeyTransacted = RtlUnalignedStringCchLengthW(pszSrc, 0x7FFFui64, &pcchLength);
    if( KeyTransacted >= 0 )
    {
      v14 = pcchLength + 1;
      PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 2 * (pcchLength + 1), 0x4C474552ui64);
      v16 = PoolWithTag;
      if( PoolWithTag )
      {
        LODWORD(dwFlags) = 256;
        KeyTransacted = RtlStringCchCopyExW(PoolWithTag, v14, (WCHAR *)pszSrc, 0i64, 0i64, dwFlags);
        if( !KeyTransacted )
        {
          v17 = (unsigned __int64)v16;
          v18 = (__int64)Handle;
          if( !Handle && !wcsnicmp(v16, L"\\REGISTRY\\MACHINE\\", 0x12ui64) )
          {
            v18 = 2147483650i64;
            v17 = (unsigned __int64)(v16 + 18);
          }
          while( 1 )
          {
            v19 = (const WCHAR *)v17;
            v20 = wcschr((WCHAR *)v17, 0x5Cu);
            v17 = (unsigned __int64)v20;
            if( v20 )
            {
              *v20 = 0;
              do
                v17 += 2i64;
              while( *(_WORD *)v17 == 92 );
              v17 &= -(__int64)(*(_WORD *)v17 != 0);
            }
            v21 = a4;
            v22 = a6;
            v23 = (ULONG *)a8;
            if( v17 )
              v21 = 4;
            if( v17 )
              v22 = 0;
            v24 = (void *)a5;
            if( v17 )
              v23 = 0i64;
            v25 = a3;
            if( v17 )
              v24 = 0i64;
            if( v17 )
              v25 = a3 & 0xFFFFFFFC;
            KeyTransacted = RegRtlCreateKeyTransacted(v18, v19, v25, v21, v24, v22, (PHANDLE)&v27, v23, a9);
            if( (HANDLE)v18 != Handle && v18 != 2147483650i64 )
              ZwClose((HANDLE)v18);
            if( KeyTransacted )
              break;
            if( !v17 )
            {
              *(_QWORD *)a7 = v27;
              break;
            }
            v18 = v27;
          }
        }
        ExFreePoolWithTag(v16, 0);
      }
      else
      {
        return(unsigned int)-1073741801;
      }
    }
  }
  return(unsigned int)KeyTransacted;
}

Referenced by:

SysCtxRegCreateTree