WmipSDRegistryQueryRoutine

NTSTATUS __stdcall WmipSDRegistryQueryRoutine(
        const WCHAR *ValueName,
        UINT64 ValueType,
        VOID *ValueData,
        UINT64 ValueLength,
        VOID *Context,
        VOID *EntryContext){
  NTSTATUS v6; 
  size_t v7; 
  VOID **PoolWithTag; 

  v6 = 0;
  v7 = ValueLength;
  if( (_DWORD)ValueType == 3 && ValueData && SeValidSecurityDescriptor((unsigned int)ValueLength, (INT64)ValueData) )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 1885957463i64);
    *(_QWORD *)EntryContext = PoolWithTag;
    if( PoolWithTag )
      memmove(PoolWithTag, ValueData, v7);
    else
      return -1073741670;
  }
  return v6;
}

Referenced by: