SecureDump_ReadRegistry

NTSTATUS __stdcall SecureDump_ReadRegistry(_UNICODE_STRING *KeyName, PWCHAR ValueName, INT64 a3, UINT8 **a4, INT64 a5){
  int v6; 
  _DWORD *v8; 
  NTSTATUS result; 
  int RegistryValue; 
  _KEY_VALUE_FULL_INFORMATION *v11; 
  ULONG DataLength; 
  VOID **PoolWithTag; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  PVOID KeyHandle; 

  KeyHandle = 0i64;
  Information = 0i64;
  v6 = a3;
  if( !a4 )
    return -1073741811;
  v8 = (_DWORD *)a5;
  if( !a5 )
    return -1073741811;
  result = IopOpenRegistryKey(&KeyHandle, 0i64, KeyName, 0x20019ui64, 0);
  if( result >= 0 )
  {
    RegistryValue = IopGetRegistryValue(KeyHandle, ValueName, 0i64, &Information);
    if( RegistryValue >= 0 )
    {
      v11 = Information;
      DataLength = Information->DataLength;
      if( DataLength )
      {
        if( v6 == Information->Type )
        {
          PoolWithTag = ExAllocatePoolWithTag(0x200ui64, DataLength, 1886217299i64);
          *a4 = (UINT8 *)PoolWithTag;
          if( PoolWithTag )
          {
            *v8 = v11->DataLength;
            memmove(*a4, (char *)v11 + v11->DataOffset, v11->DataLength);
          }
          else
          {
            RegistryValue = -1073741670;
          }
        }
        else
        {
          RegistryValue = -1073741788;
        }
      }
      else
      {
        RegistryValue = -1073741820;
      }
      ExFreePoolWithTag(v11, 0);
    }
    ObCloseHandle(KeyHandle, 0);
    return RegistryValue;
  }
  return result;
}

Referenced by: