RtlpGetBootStatusPathFromRegistry

INT64 __fastcall RtlpGetBootStatusPathFromRegistry(UINT8 **a1, INT64 a2, WCHAR a3){
  NTSTATUS v4; 
  WCHAR v5; 
  NTSTATUS v6; 
  UINT8 *PoolWithTag; 
  UINT8 *v9; 
  UINT8 *v10; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG ResultLength; 
  ULONG v14; 
  void *KeyHandle; 
  v14 = 0;
  KeyHandle = 0i64;
  ResultLength = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control", a3);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( v4 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"OsBootstatPath", v5);
    v6 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, 0i64, 0, &ResultLength);
    v4 = v6;
    if( v6 == -1073741789 )
    {
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, ResultLength, 0x66647362ui64);
      if( PoolWithTag )
      {
        v4 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, PoolWithTag, ResultLength, &v14);
        if( v4 >= 0 )
        {
          v9 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, *((unsigned int *)PoolWithTag + 2), 0x66647362ui64);
          v10 = v9;
          if( v9 )
          {
            memmove(v9, PoolWithTag + 12, *((unsigned int *)PoolWithTag + 2));
            *a1 = v10;
          }
          else
          {
            v4 = -1073741801;
          }
        }
        ExFreePoolWithTag(PoolWithTag, 0);
      }
      else
      {
        return(unsigned int)-1073741801;
      }
    }
    else if( v6 >= 0 )
    {
      return(unsigned int)-1073741823;
    }
  }
  return(unsigned int)v4;
}

Referenced by: