PiDqOpenUserObjectRegKey

INT64 __fastcall PiDqOpenUserObjectRegKey(
        WCHAR *a1,
        UINT64 a2,
        INT64 a3,
        CHAR a4,
        SECURITY_SUBJECT_CONTEXT *a5,
        VOID **a6){
  bool v6; 
  unsigned int v7; 
  WCHAR *v9; 
  void *v10; 
  __int64 v11; 
  int RelativeObjectRegPath; 
  bool v13; 
  bool v14; 
  struct _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  struct _SECURITY_SUBJECT_CONTEXT *v16; 
  void *PrimaryToken; 
  int v18; 
  int v19; 
  __int64 v20; 
  __int64 v21; 
  int Tree; 
  int v25; 
  ACCESS_MASK v26; 
  VOID *v27; 
  HANDLE Handle; 
  INT64 v29; 
  WCHAR *OutString; 
  PVOID TokenInformation; 
  WCHAR *v32; 
  struct _UNICODE_STRING UnicodeString; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  char Sid[80]; 
  v6 = 0;
  v26 = a3;
  v7 = a2;
  LODWORD(v29) = a2;
  v32 = a1;
  TokenInformation = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v9 = 0i64;
  OutString = 0i64;
  Handle = 0i64;
  v10 = 0i64;
  UnicodeString = 0i64;
  v27 = 0i64;
  v25 = 0;
  memset((INT64)Sid, 0i64);
  *a6 = 0i64;
  RelativeObjectRegPath = PnpValidateObjectName(v11, (__int64)a1, v7);
  if( RelativeObjectRegPath >= 0 )
  {
    v13 = a5 == 0i64;
    if( !a5 )
    {
      SeCaptureSubjectContext(&SubjectContext);
      v13 = 1;
    }
    v14 = v13;
    p_SubjectContext = &SubjectContext;
    if( a5 )
      p_SubjectContext = a5;
    v13 = p_SubjectContext->ClientToken == 0i64;
    v16 = &SubjectContext;
    if( v13 )
    {
      if( a5 )
        v16 = a5;
      PrimaryToken = v16->PrimaryToken;
    }
    else
    {
      if( a5 )
        v16 = a5;
      PrimaryToken = v16->ClientToken;
    }
    v18 = SeQueryInformationToken(PrimaryToken, TokenImpersonationLevel, &TokenInformation);
    RelativeObjectRegPath = v18;
    if( v18 >= 0 )
    {
      if( *(int *)TokenInformation < 2 )
      {
        RelativeObjectRegPath = -1073741790;
        v6 = v14;
        goto LABEL_28;
      }
      goto LABEL_12;
    }
    v6 = v14;
    if( v18 == -1073741821 )
    {
LABEL_12:
      SeQueryUserSidToken(PrimaryToken, Sid, 0x44ui64, 0i64);
      RelativeObjectRegPath = RtlConvertSidToUnicodeString(&UnicodeString, Sid, 1u);
      v6 = v14;
      if( RelativeObjectRegPath >= 0 )
      {
        PnpConcatPWSTR(0x7FFFFFFFui64, 0x58706E50ui64, &OutString, 2ui64, L"\\REGISTRY\\USER\\", UnicodeString.Buffer);
        RelativeObjectRegPath = v19;
        if( v19 < 0 )
        {
          v9 = OutString;
        }
        else
        {
          if( PiPnpRtlCtx )
            v20 = *(_QWORD *)(PiPnpRtlCtx + 224);
          else
            v20 = 0i64;
          v9 = OutString;
          RelativeObjectRegPath = SysCtxRegOpenKey(v20, 0i64, OutString, 0, 4u, &Handle);
          if( RelativeObjectRegPath >= 0 )
          {
            RelativeObjectRegPath = PiDqGetRelativeObjectRegPath(v32, (unsigned int)v29, &v27);
            if( RelativeObjectRegPath < 0 )
            {
              v10 = v27;
            }
            else
            {
              if( a4 )
              {
                v10 = v27;
                Tree = PnpCtxRegCreateTree(
                         PiPnpRtlCtx,
                         Handle,
                         (const wchar_t *)v27,
                         0,
                         v26,
                         0i64,
                         (__int64)a6,
                         (__int64)&v25);
              }
              else
              {
                v25 = 2;
                if( PiPnpRtlCtx )
                  v21 = *(_QWORD *)(PiPnpRtlCtx + 224);
                else
                  v21 = 0i64;
                v10 = v27;
                Tree = SysCtxRegOpenKey(v21, (char *)Handle, (const WCHAR *)v27, 0, v26, a6);
              }
              RelativeObjectRegPath = Tree;
              v6 = v14;
              if( Tree >= 0 )
                v6 = v14;
            }
          }
        }
      }
    }
  }
  if( RelativeObjectRegPath == -1073741444 )
    RelativeObjectRegPath = -1073741772;
  if( v10 )
    ExFreePoolWithTag(v10, 0x58706E50u);
LABEL_28:
  if( Handle )
    ZwClose(Handle);
  if( v9 )
    ExFreePoolWithTag(v9, 0x58706E50u);
  RtlFreeAnsiString(&UnicodeString);
  if( v6 )
    SeReleaseSubjectContext(&SubjectContext);
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  return(unsigned int)RelativeObjectRegPath;
}

Referenced by: