SecureDump_ReadRegistry

NTSTATUS __fastcall SecureDump_ReadRegistry(UNICODE_STRING *KeyName, PWCHAR ValueName, INT64 a3, UINT8 **a4, INT64 a5){
  int v6; 
  _DWORD *v8; 
  NTSTATUS result; 
  int RegistryValue; 
  unsigned int *v11; 
  unsigned int v12; 
  UINT8 *PoolWithTag; 
  void *P[5]; 
  HANDLE Handle; 
  Handle = 0i64;
  P[0] = 0i64;
  v6 = a3;
  if( !a4 )
    return -1073741811;
  v8 = (_DWORD *)a5;
  if( !a5 )
    return -1073741811;
  result = IopOpenRegistryKey(&Handle, 0i64, KeyName, 0x20019ui64, 0);
  if( result >= 0 )
  {
    RegistryValue = IopGetRegistryValue(Handle, ValueName, 0i64, (KEY_VALUE_FULL_INFORMATION **)P);
    if( RegistryValue >= 0 )
    {
      v11 = (unsigned int *)P[0];
      v12 = *((_DWORD *)P[0] + 3);
      if( v12 )
      {
        if( v6 == *((_DWORD *)P[0] + 1) )
        {
          PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, v12, 0x706D6453ui64);
          *a4 = PoolWithTag;
          if( PoolWithTag )
          {
            *v8 = v11[3];
            memmove(*a4, (UINT8 *)v11 + v11[2], v11[3]);
          }
          else
          {
            RegistryValue = -1073741670;
          }
        }
        else
        {
          RegistryValue = -1073741788;
        }
      }
      else
      {
        RegistryValue = -1073741820;
      }
      ExFreePoolWithTag(v11, 0);
    }
    ObCloseHandle(Handle, 0);
    return RegistryValue;
  }
  return result;
}

Referenced by: