PspReadIFEOPerfOptions

VOID __fastcall PspReadIFEOPerfOptions(VOID *KeyHandle, INT64 a2){
  ULONG v2; 
  int inited; 
  __int128 *p_KeyValueInformation; 
  NTSTATUS v7; 
  void *v8; 
  int v9; 
  ULONG v10; 
  void *PoolWithQuotaTag; 
  NTSTATUS v12; 
  UINT64 Length; 
  UINT64 Lengtha; 
  UINT64 Lengthb; 
  ULONG ResultLength; 
  UINT64 Value; 
  struct _UNICODE_STRING DestinationString; 
  __int128 KeyValueInformation; 
  int v20; 
  v2 = 0;
  LODWORD(Value) = 0;
  LODWORD(Length) = 4;
  if( (int)RtlQueryImageFileKeyOption(KeyHandle, L"IoPriority", 4ui64, (VOID *)(a2 + 8), Length, 0i64) >= 0 )
    *(_DWORD *)a2 |= 1u;
  LODWORD(Lengtha) = 4;
  if( (int)RtlQueryImageFileKeyOption(KeyHandle, L"PagePriority", 4ui64, (VOID *)(a2 + 12), Lengtha, 0i64) >= 0 )
    *(_DWORD *)a2 |= 2u;
  LODWORD(Lengthb) = 4;
  if( (int)RtlQueryImageFileKeyOption(KeyHandle, L"CpuPriorityClass", 4ui64, (VOID *)(a2 + 16), Lengthb, 0i64) >= 0 )
    *(_DWORD *)a2 |= 4u;
  ResultLength = 0;
  v20 = 0;
  DestinationString = 0i64;
  KeyValueInformation = 0i64;
  inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"WorkingSetLimitInKB");
  if( inited < 0 )
    goto LABEL_10;
  p_KeyValueInformation = &KeyValueInformation;
  v7 = ZwQueryValueKey(
         KeyHandle,
         &DestinationString,
         KeyValuePartialInformation,
         &KeyValueInformation,
         0x14u,
         &ResultLength);
  inited = v7;
  if( v7 >= 0 )
  {
    v8 = 0i64;
LABEL_14:
    v9 = *((_DWORD *)p_KeyValueInformation + 1);
    if( ((v9 - 3) & 0xFFFFFFFB) != 0 )
    {
      if( v9 == 4 )
      {
        if( *((_DWORD *)p_KeyValueInformation + 2) == 4 )
        {
          ResultLength = 4;
          v2 = *((_DWORD *)p_KeyValueInformation + 3);
        }
        else
        {
          inited = -1073741820;
        }
LABEL_21:
        if( v8 )
          ExFreePoolWithTag(v8, 0);
        goto LABEL_10;
      }
      if( v9 != 11 && v9 == 1 )
      {
        if( ((unsigned __int8)&Value & 3) != 0 )
        {
          inited = -2147483646;
          goto LABEL_21;
        }
        ResultLength = 4;
        DestinationString.Buffer = (wchar_t *)p_KeyValueInformation + 6;
        DestinationString.Length = *((_WORD *)p_KeyValueInformation + 4);
        DestinationString.MaximumLength = *((_WORD *)p_KeyValueInformation + 4);
        inited = RtlUnicodeStringToInteger(&DestinationString, 0i64, &Value);
        goto LABEL_32;
      }
    }
    else if( v9 == 4 )
    {
      ResultLength = *((_DWORD *)p_KeyValueInformation + 2);
      if( *((_DWORD *)p_KeyValueInformation + 2) > 4u )
      {
        inited = -2147483643;
        goto LABEL_21;
      }
      memmove((UINT8 *)&Value, (UINT8 *)p_KeyValueInformation + 12, *((unsigned int *)p_KeyValueInformation + 2));
LABEL_32:
      v2 = Value;
      goto LABEL_21;
    }
    inited = -1073741788;
    goto LABEL_21;
  }
  if( v7 != -2147483643 )
  {
LABEL_10:
    if( inited >= 0 )
    {
      *(_DWORD *)(a2 + 4) |= 1u;
      *(_QWORD *)(a2 + 24) = (unsigned __int64)v2 >> 2;
    }
    return;
  }
  while( 1 )
  {
    v10 = ResultLength;
    PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, ResultLength, 0x6B497452ui64);
    v8 = PoolWithQuotaTag;
    if( !PoolWithQuotaTag )
      break;
    p_KeyValueInformation = (__int128 *)PoolWithQuotaTag;
    v12 = ZwQueryValueKey(
            KeyHandle,
            &DestinationString,
            KeyValuePartialInformation,
            PoolWithQuotaTag,
            v10,
            &ResultLength);
    inited = v12;
    if( v12 >= 0 )
      goto LABEL_14;
    if( v12 != -2147483643 )
      goto LABEL_21;
    ExFreePoolWithTag(v8, 0);
  }
}

Referenced by: