FsRtlGetTunnelParameterValue

NTSTATUS __stdcall FsRtlGetTunnelParameterValue(
        _UNICODE_STRING *ValueName,
        UINT64 *Value,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  NTSTATUS result; 
  unsigned int v11; 
  unsigned int *v12; 
  char *i; 
  int v14; 
  VOID **PoolWithTag; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v19; 
  VOID *KeyHandle; 
  int v21[2]; 
  const WCHAR *v22; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[96]; 

  LODWORD(v19) = 0;
  v21[1] = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  v22 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem";
  v21[0] = 8126586;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v21;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  result = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, a4, Length, (INT64)ResultLength, v19, 0i64);
  if( result >= 0 )
  {
    v11 = 92;
    v12 = (unsigned int *)KeyValueInformation;
    for( i = KeyValueInformation; ; i = (char *)PoolWithTag )
    {
      LODWORD(Lengtha) = v11;
      v14 = ZwQueryValueKey(KeyHandle, ValueName, KeyValueFullInformation, i, Lengtha, &v19);
      if( v14 != -2147483643 )
        break;
      if( v12 != (unsigned int *)KeyValueInformation )
        ExFreePoolWithTag(v12, 0);
      v11 += 256;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v11, 1265530196i64);
      v12 = (unsigned int *)PoolWithTag;
      if( !PoolWithTag )
        return -1073741801;
    }
    ZwClose((_HANDLE)KeyHandle);
    if( v14 >= 0 )
    {
      if( v12[3] )
        *(_DWORD *)Value = *(unsigned int *)((char *)v12 + v12[2]);
      else
        v14 = -1073741772;
    }
    if( v12 != (unsigned int *)KeyValueInformation )
      ExFreePoolWithTag(v12, 0);
    return v14;
  }
  return result;
}

Referenced by: