CcQueryRegKeyValue

UINT32 __fastcall CcQueryRegKeyValue(UINT64 a1, INT64 a2){
  ULONG *v2; 
  PVOID *v3; 
  ULONG *v4; 
  PVOID *v6; 
  UINT32 result; 
  ULONG Length; 
  PVOID PoolWithTag; 
  _BYTE *i; 
  NTSTATUS v11; 
  signed __int32 v12; 
  void *KeyHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG ResultLength; 
  _BYTE *v16; 
  KeyHandle = 0i64;
  v4 = v2;
  ResultLength = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)a1;
  v6 = v3;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  result = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( (result & 0x80000000) == 0 )
  {
    if( a2 )
    {
      Length = *v4;
      PoolWithTag = *v6;
      for( i = v16; ; *i = 1 )
      {
        v11 = ZwQueryValueKey(
                KeyHandle,
                (PUNICODE_STRING)a2,
                KeyValueFullInformation,
                PoolWithTag,
                Length,
                &ResultLength);
        v12 = v11;
        if( v11 != -1073741789 && v11 != -2147483643 )
          break;
        if( Length != *v4 )
          break;
        Length = ResultLength;
        if( ResultLength > 0x40000
          || (PoolWithTag = ExAllocatePoolWithTag(PagedPool, ResultLength, 0x78666343ui64)) == 0i64 )
        {
          v12 = -1073741670;
          break;
        }
        if( *i )
          ExFreePoolWithTag(*v6, 0x78666343u);
        *v6 = PoolWithTag;
        *v4 = Length;
      }
      ZwClose(KeyHandle);
      if( v12 >= 0 && !*((_DWORD *)*v6 + 3) )
        return -1073741772;
      return v12;
    }
    else
    {
      ZwClose(KeyHandle);
      return 0;
    }
  }
  return result;
}

Referenced by: