NtQueryLicenseValue

INT64 __fastcall NtQueryLicenseValue(
        _UNICODE_STRING *ValueName,
        UINT64 *Type,
        VOID *Data,
        UINT64 DataSize,
        UINT64 *ResultDataSize){
  UINT64 v5; 
  int v8; 
  char v9; 
  UINT64 *v10; 
  int v11; 
  wchar_t *Buffer; 
  unsigned __int64 v13; 
  void *PoolWithTag; 
  wchar_t *v15; 
  __int64 v16; 
  __int64 v17; 
  INT64 v18; 
  int v19; 
  int v20; 
  unsigned int v21; 
  UINT64 v23; 
  char Size[12]; 
  PVOID P; 
  UNICODE_STRING v26; 
  INT64 v27; 
  UINT64 *v28; 
  VOID *v29; 
  int v30; 
  v30 = DataSize;
  v29 = Data;
  v28 = Type;
  v5 = (unsigned int)DataSize;
  v26 = 0i64;
  v8 = 0;
  P = 0i64;
  LODWORD(v27) = 0;
  memset(Size, 0, sizeof(Size));
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( ValueName && (v10 = ResultDataSize) != 0i64 && (Data || !(_DWORD)DataSize) )
  {
    if( (unsigned int)DataSize > 0x800000 )
    {
      v8 = -1073741801;
    }
    else if( v9 )
    {
      if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
        ValueName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
      v11 = *(_DWORD *)&ValueName->Length;
      *(_DWORD *)&v26.Length = *(_DWORD *)&ValueName->Length;
      Buffer = ValueName->Buffer;
      v26.Buffer = Buffer;
      if( Buffer && (_WORD)v11 && (v11 & 1) == 0 )
      {
        if( ((unsigned __int8)Buffer & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v13 = (unsigned __int64)Buffer + (unsigned __int16)v11;
        if( v13 > 0x7FFFFFFF0000i64 || v13 < (unsigned __int64)Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, v26.Length, 0x20534C53ui64);
        P = PoolWithTag;
        if( PoolWithTag )
        {
          v15 = (wchar_t *)PoolWithTag;
          memmove((UINT8 *)PoolWithTag, (UINT8 *)v26.Buffer, v26.Length);
          v26.Buffer = v15;
          if( Type )
          {
            v16 = (__int64)Type;
            if( (unsigned __int64)Type >= 0x7FFFFFFF0000i64 )
              v16 = 0x7FFFFFFF0000i64;
            *(_DWORD *)v16 = *(_DWORD *)v16;
            LODWORD(v27) = *(_DWORD *)Type;
          }
          if( Data
            && (_DWORD)v5
            && (ProbeForWrite(Data, v5, 1ui64),
                (*(_QWORD *)&Size[4] = ExAllocatePoolWithTag(PagedPool, v5, 0x20534C53ui64)) == 0i64) )
          {
            v8 = -1073741801;
          }
          else
          {
            v17 = (__int64)v10;
            if( (unsigned __int64)v10 >= 0x7FFFFFFF0000i64 )
              v17 = 0x7FFFFFFF0000i64;
            *(_DWORD *)v17 = *(_DWORD *)v17;
            *(_DWORD *)Size = *(_DWORD *)v10;
          }
        }
        else
        {
          v8 = -1073741801;
        }
      }
      else
      {
        v8 = -1073741811;
      }
      if( v8 >= 0 )
      {
        v18 = PsGetCurrentServerSiloGlobals()[113];
        if( qword_140D2C500 )
        {
          v19 = qword_140D2C500(v18, &v26, &v27, *(_QWORD *)&Size[4], v5, Size);
        }
        else
        {
          LODWORD(v23) = v5;
          v19 = SLQueryLicenseValueInternal(v18, &v26, (INT64)&v27, *(VOID **)&Size[4], v23, (UINT64 *)Size);
        }
        v20 = v19;
        v8 = v19;
        if( Type )
          *(_DWORD *)Type = v27;
        v21 = *(_DWORD *)Size;
        *(_DWORD *)v10 = *(_DWORD *)Size;
        if( v20 >= 0 && Data )
        {
          if( (unsigned int)v5 < v21 )
            v8 = -1073741789;
          else
            memmove((UINT8 *)Data, *(UINT8 **)&Size[4], v21);
        }
      }
    }
    else
    {
      v8 = ntoskrnl_27(ValueName, (INT64)Type, Data, (unsigned int)DataSize, ResultDataSize);
    }
  }
  else
  {
    v8 = -1073741811;
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  if( *(_QWORD *)&Size[4] )
    ExFreePoolWithTag(*(PVOID *)&Size[4], 0);
  return(unsigned int)v8;
}

Referenced by: