AslpProcessMatchRegNode

INT64 __fastcall AslpProcessMatchRegNode(INT64 a1, INT64 a2, INT64 a3){
  _QWORD *v4; 
  void *v5; 
  int Key; 
  UINT8 *Buffer; 
  __int64 v8; 
  __int64 v9; 
  wchar_t *v10; 
  INT64 v11; 
  __int64 v12; 
  VOID *v13; 
  __int16 *v14; 
  __int16 v15; 
  NTSTATUS v16; 
  __int64 v17; 
  WCHAR *v18; 
  void *v19; 
  struct _UNICODE_STRING Destination; 
  Destination = 0i64;
  if( *(_QWORD *)(a1 + 8) == a2 )
  {
    v4 = (_QWORD *)(a1 + 32);
    v5 = *(void **)(a1 + 32);
    if( v5 )
    {
      ZwClose(v5);
      *v4 = 0i64;
      Key = -2147483622;
    }
    else
    {
      Key = AslRegistryGetKey();
    }
    Buffer = (UINT8 *)Destination.Buffer;
  }
  else
  {
    v8 = *(_QWORD *)(a1 + 24);
    v9 = -1i64;
    do
      ++v9;
    while( *(_WORD *)(v8 + 2 * v9) );
    Destination.MaximumLength = 2 * (v9 + 261);
    v10 = (wchar_t *)AslAlloc((VOID *)0x105, Destination.MaximumLength, a3);
    v12 = *(_QWORD *)(a1 + 8);
    Buffer = (UINT8 *)v10;
    Destination.Buffer = v10;
    v13 = *(VOID **)(v12 + 32);
    while( 1 )
    {
      *(_WORD *)Buffer = 0;
      Key = AslRegistryEnumKey(Buffer, v11, v13, *(unsigned int *)(a1 + 40));
      if( Key < 0 )
        break;
      v14 = *(__int16 **)(a1 + 24);
      ++*(_DWORD *)(a1 + 40);
      v15 = *v14;
      *v14 = 0;
      v16 = AslStringPatternMatchW(*(PWCHAR *)(a1 + 16), (PWCHAR)Buffer);
      **(_WORD **)(a1 + 24) = v15;
      if( v16 )
      {
        v17 = -1i64;
        do
          ++v17;
        while( *(_WORD *)&Buffer[2 * v17] );
        v18 = *(WCHAR **)(a1 + 24);
        Destination.Length = 2 * v17;
        RtlAppendUnicodeToString(&Destination, v18);
        v19 = *(void **)(a1 + 32);
        if( v19 )
        {
          ZwClose(v19);
          *(_QWORD *)(a1 + 32) = 0i64;
        }
        Buffer = (UINT8 *)Destination.Buffer;
        Key = AslRegistryOpenSubKey((PHANDLE)(a1 + 32));
        if( Key >= 0 )
          goto LABEL_18;
      }
    }
    *(_DWORD *)(a1 + 40) = 0;
  }
LABEL_18:
  if( Buffer )
    ExFreePoolWithTag(Buffer, 0x74705041u);
  return(unsigned int)Key;
}

Referenced by: