PopReadRegKeyValue

INT64 __fastcall PopReadRegKeyValue(WCHAR *SourceString, WCHAR *a2, size_t Size, INT64 a4, VOID *dst){
  int v6; 
  UINT8 *PoolWithTag; 
  NTSTATUS v9; 
  WCHAR v10; 
  ULONG ResultLength; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ResultLength = 0;
  KeyHandle = 0i64;
  v6 = a4;
  DestinationString = 0i64;
  PoolWithTag = 0i64;
  RtlInitUnicodeString(&DestinationString, SourceString, Size);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( v9 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, a2, v10);
    v9 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, 0i64, 0, &ResultLength);
    if( v9 == -1073741789 )
    {
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, ResultLength, 0x50455654ui64);
      if( !PoolWithTag )
      {
        v9 = -1073741801;
        goto LABEL_4;
      }
      v9 = ZwQueryValueKey(
             KeyHandle,
             &DestinationString,
             KeyValuePartialInformation,
             PoolWithTag,
             ResultLength,
             &ResultLength);
    }
    if( v9 >= 0 )
    {
      if( !v6 || *((_DWORD *)PoolWithTag + 1) == v6 )
      {
        if( *((_DWORD *)PoolWithTag + 2) == Size )
          memmove((UINT8 *)dst, PoolWithTag + 12, Size);
        else
          v9 = -1073741789;
      }
      else
      {
        v9 = -1073741788;
      }
    }
  }
LABEL_4:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x50455654u);
  return(unsigned int)v9;
}

Referenced by: