BiGetRegistryValue

INT64 __fastcall BiGetRegistryValue(
        VOID *ParentHandle,
        WCHAR *ValueName,
        WCHAR *KeyName,
        UINT64 Type,
        VOID **Buffer,
        UINT64 *Length){
  WCHAR *v7; 
  unsigned int i; 
  UINT8 *PoolWithTag; 
  VOID *v11; 
  int v12; 
  PVOID v13; 
  VOID *v14; 
  UINT64 v16; 
  UINT64 NumberOfBytes; 
  UINT64 v18; 
  PVOID Handle; 
  struct _UNICODE_STRING DestinationString; 
  int v22; 
  v22 = Type;
  v7 = ValueName;
  LODWORD(v18) = 0;
  LODWORD(NumberOfBytes) = 0;
  DestinationString = 0i64;
  for( i = 0; ; ++i )
  {
    PoolWithTag = 0i64;
    Handle = 0i64;
    *Buffer = 0i64;
    *(_DWORD *)Length = 0;
    RtlInitUnicodeString(&DestinationString, v7, (WCHAR)KeyName);
    LODWORD(v11) = BiSanitizeHandle(ParentHandle);
    ParentHandle = v11;
    if( KeyName )
    {
      v12 = BiOpenKey(v11, KeyName, 0x20019ui64, &Handle);
      HIDWORD(NumberOfBytes) = v12;
      v13 = Handle;
      if( v12 < 0 )
        goto LABEL_11;
    }
    else
    {
      v13 = v11;
    }
    LODWORD(v16) = 0;
    v12 = BiZwQueryValueKey(v13, &DestinationString, (_KEY_VALUE_INFORMATION_CLASS)KeyName, 0i64, v16, &NumberOfBytes);
    HIDWORD(NumberOfBytes) = v12;
    if( v12 == -1073741789 )
    {
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x4B444342ui64);
      if( !PoolWithTag )
        goto LABEL_19;
      LODWORD(v16) = NumberOfBytes;
      v12 = BiZwQueryValueKey(v13, &DestinationString, (_KEY_VALUE_INFORMATION_CLASS)KeyName, PoolWithTag, v16, &v18);
      HIDWORD(NumberOfBytes) = v12;
      if( v12 >= 0 )
      {
        if( *((_DWORD *)PoolWithTag + 1) == v22 )
        {
          LODWORD(NumberOfBytes) = NumberOfBytes - 12;
          v14 = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x4B444342ui64);
          *Buffer = v14;
          if( v14 )
          {
            memmove((UINT8 *)v14, PoolWithTag + 12, (unsigned int)NumberOfBytes);
            *(_DWORD *)Length = NumberOfBytes;
            v12 = 0;
          }
          else
          {
LABEL_19:
            v12 = -1073741670;
          }
        }
        else
        {
          v12 = -1073741788;
        }
        HIDWORD(NumberOfBytes) = v12;
      }
    }
LABEL_11:
    if( v13 != ParentHandle && v13 )
      CmSiCloseSection(v13);
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0x4B444342u);
    if( v12 != -1073741443 )
      break;
    __debugbreak();
    if( i >= 5 )
      break;
    v7 = ValueName;
  }
  return(unsigned int)v12;
}

Referenced by: