RtlGetPersistedStateLocation

INT64 __fastcall RtlGetPersistedStateLocation(
        WCHAR *SourceString,
        const WCHAR *a2,
        _WORD *a3,
        UINT64 a4,
        VOID *dst,
        UINT64 a6,
        UINT64 *a7){
  UINT8 *PoolWithTag; 
  signed int v11; 
  __int64 v13; 
  unsigned int v14; 
  unsigned int v15; 
  UINT8 *v16; 
  NTSTATUS v17; 
  WCHAR v18; 
  NTSTATUS v19; 
  WCHAR v20; 
  unsigned int v21; 
  ULONG Length; 
  NTSTATUS v23; 
  unsigned __int64 v24; 
  void *KeyHandle; 
  HANDLE Handle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG ResultLength; 
  KeyHandle = 0i64;
  Handle = 0i64;
  ResultLength = 0;
  PoolWithTag = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  if( (unsigned int)a4 > 1 )
    return 3221225713i64;
  if( byte_140C4C2E9 )
  {
    v11 = -1073741772;
  }
  else
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&qword_1409844A8[2 * (int)a4];
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v17 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
    v11 = v17;
    if( v17 == -1073741772 )
    {
      byte_140C4C2E9 = 1;
    }
    else
    {
      if( v17 < 0 )
        goto LABEL_5;
      RtlInitUnicodeString(&DestinationString, SourceString, v18);
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v19 = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
      v11 = v19;
      if( v19 != -1073741772 )
      {
        if( v19 < 0 )
          goto LABEL_5;
        if( !a2 )
          a2 = L"TargetNtPath";
        RtlInitUnicodeString(&DestinationString, a2, v20);
        v21 = a6;
        Length = a6 + 16;
        if( (int)a6 + 16 >= (unsigned int)a6 )
        {
          PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, Length, 0x70657373ui64);
          if( !PoolWithTag )
          {
            v11 = -1073741801;
            goto LABEL_5;
          }
          v23 = ZwQueryValueKey(
                  Handle,
                  &DestinationString,
                  KeyValuePartialInformation,
                  PoolWithTag,
                  Length,
                  &ResultLength);
          v11 = v23;
          if( v23 < 0 )
          {
            if( v23 != -2147483643 )
              goto LABEL_5;
          }
          else if( *((_DWORD *)PoolWithTag + 1) != 1 )
          {
            v11 = -1073741788;
            goto LABEL_5;
          }
          v15 = *((_DWORD *)PoolWithTag + 2);
          ResultLength = v15;
          if( v23 >= 0 && *(_WORD *)&PoolWithTag[2 * ((unsigned __int64)v15 >> 1) + 10] )
          {
            v24 = v15 + 2;
            ResultLength = v24;
            v15 += 2;
            if( v21 < (unsigned int)v24 )
            {
              v11 = -2147483643;
            }
            else
            {
              *(_WORD *)&PoolWithTag[2 * (v24 >> 1) + 10] = 0;
              v15 = ResultLength;
            }
          }
          if( a7 )
            *(_DWORD *)a7 = v15;
          if( v11 < 0 )
            goto LABEL_5;
          v16 = PoolWithTag + 12;
          goto LABEL_19;
        }
LABEL_31:
        v11 = -1073741675;
        goto LABEL_5;
      }
    }
  }
  if( a3 )
  {
    v13 = -1i64;
    do
      ++v13;
    while( a3[v13] );
    v14 = v13 + 1;
    v15 = 2 * v14;
    ResultLength = 2 * v14;
    if( 2 * v14 >= v14 )
    {
      v11 = (unsigned int)a6 < v15 ? 0x80000005 : 0;
      if( a7 )
        *(_DWORD *)a7 = v15;
      if( v15 > (unsigned int)a6 )
        goto LABEL_5;
      v16 = (UINT8 *)a3;
LABEL_19:
      memmove((UINT8 *)dst, v16, v15);
      goto LABEL_5;
    }
    goto LABEL_31;
  }
LABEL_5:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( Handle )
    ZwClose(Handle);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return(unsigned int)v11;
}

Referenced by: