RtlQueryRegistryValueWithFallback

NTSTATUS __stdcall RtlQueryRegistryValueWithFallback(
        _HANDLE PrimaryHandle,
        _HANDLE FallbackHandle,
        PUNICODE_STRING ValueName,
        ULONG ValueLength,
        PULONG ValueType,
        PVOID ValueData,
        PULONG ResultLength){
  VOID *v8; 
  VOID *v9; 
  ULONG v10; 
  unsigned int *PoolWithTag; 
  int v12; 
  UINT64 Length; 
  UINT64 v15; 

  LODWORD(v15) = 0;
  v8 = *(VOID **)&FallbackHandle;
  v9 = *(VOID **)&PrimaryHandle;
  if( __PAIR128__(*(unsigned __int64 *)&PrimaryHandle, *(unsigned __int64 *)&FallbackHandle) == 0 )
    return -1073741811;
  v10 = ValueLength + 16;
  if( ValueLength >= 0xFFFFFFF0 )
    return -1073741675;
  PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(1ui64, v10, 1835824242i64);
  if( !PoolWithTag )
    return -1073741801;
  v12 = -1073741772;
  if( v9 )
  {
    LODWORD(Length) = v10;
    v12 = ZwQueryValueKey(v9, ValueName, KeyValuePartialInformation, PoolWithTag, Length, &v15);
    if( v12 != -1073741772 )
      goto LABEL_8;
  }
  if( v8 )
  {
    LODWORD(Length) = v10;
    v12 = ZwQueryValueKey(v8, ValueName, KeyValuePartialInformation, PoolWithTag, Length, &v15);
LABEL_8:
    if( (int)(v12 + 0x80000000) < 0 || v12 == -2147483643 )
    {
      *ResultLength = PoolWithTag[2];
      if( ValueType )
        *ValueType = PoolWithTag[1];
      if( v12 >= 0 )
        memmove(ValueData, PoolWithTag + 3, PoolWithTag[2]);
    }
  }
  ExFreePoolWithTag(PoolWithTag, 0);
  return v12;
}

Referenced by: