KsepRegistryQueryDWORD
INT64 __stdcall KsepRegistryQueryDWORD(PVOID KeyHandle, WCHAR *ValueName, UINT64 *Value){
UINT64 *v3;
INT64 result;
__int64 v7;
__int64 v8;
ULONG ResultLength;
struct _UNICODE_STRING DestinationString;
char KeyValueInformation[4];
int v12;
int v13;
int v14;
v3 = Value;
DestinationString = 0i64;
if( !KeyHandle )
{
LOWORD(Value) = 646;
v7 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
KsepHistoryErrors[2 * v7 + 1] = -1073740768;
KsepHistoryErrors[2 * v7] = 262790;
if( (KsepDebugFlag & 4) != 0 )
RtlAssert("KeyHandle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x286u, 0i64);
}
if( !v3 )
{
LOWORD(Value) = 647;
v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
KsepHistoryErrors[2 * v8 + 1] = -1073740768;
KsepHistoryErrors[2 * v8] = 262791;
if( (KsepDebugFlag & 4) != 0 )
RtlAssert("Value != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x287u, 0i64);
}
*(_DWORD *)v3 = 0;
ResultLength = 20;
RtlInitUnicodeString(&DestinationString, ValueName, (WCHAR)Value);
LODWORD(result) = ZwQueryValueKey(
KeyHandle,
&DestinationString,
KeyValuePartialInformation,
KeyValueInformation,
0x14u,
&ResultLength);
if( !(_DWORD)result )
{
if( v13 == 4 && v12 == 4 )
*(_DWORD *)v3 = v14;
else
return 3221225508i64;
}
return result;
}Referenced by:
KsepEngineReadFlags