SdbResolveDatabaseEx

INT64 __fastcall SdbResolveDatabaseEx(INT64 a1, UINT64 *a2, _DWORD *a3, INT64 *a4, _WORD *a5, UINT64 ValueOut){
  __int64 v11; 
  wchar_t *v12; 
  GUID **v13; 
  INT64 v14; 
  GUID *v15; 
  UINT64 v16; 
  NTSTATUS v17; 
  VOID *v18; 
  INT64 v19; 
  INT64 v20; 
  int v21; 
  int v22; 
  INT64 v23; 
  int v24; 
  unsigned int v26; 
  wchar_t *v27; 
  NTSTATUS v28; 
  INT64 v29; 
  int v30; 
  int v31; 
  wchar_t *Buffer; 
  UINT64 v33; 
  void *KeyHandle; 
  struct _UNICODE_STRING Destination; 
  UNICODE_STRING Source; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int a5a; 
  LODWORD(ValueOut) = 0;
  LODWORD(v33) = 0;
  KeyHandle = 0i64;
  LODWORD(v11) = 0;
  v12 = 0i64;
  Destination = 0i64;
  Source = 0i64;
  if( !a5 )
    return 0i64;
  *a5 = 0;
  v13 = &off_140C0EFF0;
  v14 = 0i64;
  while( 1 )
  {
    v15 = *v13;
    v16 = *(_QWORD *)&(*v13)->Data1 - *a2;
    if( !v16 )
      v16 = *(_QWORD *)v15->Data4 - a2[1];
    if( !v16 )
      break;
    v14 = (unsigned int)(v14 + 1);
    v13 += 3;
    if( (unsigned int)v14 >= 3 )
      goto LABEL_7;
  }
  v20 = *((unsigned int *)&off_140C0EFF0 + 6 * (int)v14 + 4);
  v21 = *((_DWORD *)&off_140C0EFF0 + 6 * (int)v14 + 2);
  v22 = *((_DWORD *)&off_140C0EFF0 + 6 * (int)v14 + 3);
  LODWORD(ValueOut) = v21;
  a5a = v22;
  if( !(_DWORD)v20 )
  {
LABEL_7:
    v17 = AslGuidToString_UStr(&Source, (_GUID *)a2);
    if( v17 < 0 )
    {
      AslLogCallPrintf(1ui64, "SdbResolveDatabaseEx", 0x7D4ui64, "Failed to convert guid to string [%x]", v17);
      goto LABEL_38;
    }
    v26 = Source.Length + 184;
    v27 = (wchar_t *)AslAlloc(v18, v26, v19);
    v12 = v27;
    if( v27 )
    {
      Destination.MaximumLength = v26;
      Destination.Buffer = v27;
      Destination.Length = 0;
      RtlAppendUnicodeToString(
        &Destination,
        (PWCHAR)L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB");
      RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\\");
      RtlAppendUnicodeStringToString(&Destination, &Source);
      *(_QWORD *)&ObjectAttributes.Length = 48i64;
      ObjectAttributes.ObjectName = &Destination;
      *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
      ObjectAttributes.RootDirectory = 0i64;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v28 = ZwOpenKey(&KeyHandle, 0x80000100, &ObjectAttributes);
      if( v28 >= 0 )
      {
        if( a3 )
        {
          AslRegistryGetUInt32_UStr(&ValueOut, KeyHandle, (UNICODE_STRING *)&g_ustrDatabaseType);
          if( v30 < 0 )
          {
            AslLogCallPrintf(1ui64, "SdbResolveDatabaseEx", 0x805ui64, "Failed to get database type [%x]", v30);
            *a3 = 0;
            goto LABEL_38;
          }
          *a3 = ValueOut & 0x7FFFFFFF;
        }
        if( a4 )
        {
          AslRegistryGetUInt32_UStr(&v33, KeyHandle, (UNICODE_STRING *)&g_ustrRuntimePlatform);
          if( v31 < 0 )
          {
            AslLogCallPrintf(1ui64, "SdbResolveDatabaseEx", 0x815ui64, "Failed to get runtime platform [%x]", v31);
            *(_DWORD *)a4 = 0;
            goto LABEL_38;
          }
          *(_DWORD *)a4 = v33;
        }
        if( SdbGetPathCustomSdb(a5, v29, a2, a1 + 576) )
        {
          v11 = -1i64;
          do
            ++v11;
          while( a5[v11] );
        }
        else
        {
          AslLogCallPrintf(
            1ui64,
            "SdbResolveDatabaseEx",
            0x81Eui64,
            "SdbGetPathCustomSdb failed to get the database path.");
        }
        goto LABEL_38;
      }
      AslLogCallPrintf(
        1ui64,
        "SdbResolveDatabaseEx",
        0x7F9ui64,
        "Failed to open Key \"%ws\" [%x]",
        Destination.Buffer,
        v28);
    }
    else
    {
      AslLogCallPrintf(1ui64, "SdbResolveDatabaseEx", 0x7E9ui64, "Failed to allocate %ld bytes for key path", v26);
    }
LABEL_38:
    if( KeyHandle )
      ZwClose(KeyHandle);
    if( v12 )
      ExFreePoolWithTag(v12, 0x74705041u);
    Buffer = Source.Buffer;
    if( Source.Buffer )
    {
      memset((INT64)Source.Buffer, 66i64);
      ExFreePoolWithTag(Buffer, 0x74705041u);
    }
    return(unsigned int)v11;
  }
  if( (int)SdbpGetSystemSdbFilePath(a5, v14, v20, (INT64)v15, 0i64, a1 + 576) < 0 )
  {
    AslLogCallPrintf(1ui64, "SdbResolveDatabaseEx", 0x7BDui64, "SdbGetPathSystemSdb failed.");
  }
  else
  {
    v11 = -1i64;
    do
      ++v11;
    while( a5[v11] );
  }
  if( a3 )
    *a3 = v21;
  if( a4 )
  {
    v24 = SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(v23);
    *(_DWORD *)a4 = v24;
    if( a5a )
      *(_DWORD *)a4 = v24 & 0x1B;
  }
  return(unsigned int)v11;
}

Referenced by: