LdrpQueryValueKey

INT64 __fastcall LdrpQueryValueKey(
        VOID *KeyHandle,
        _UNICODE_STRING *KeyValueName,
        UINT64 *KeyValueType,
        VOID *KeyValue,
        UINT64 *KeyValueLength,
        _LARGE_INTEGER *LastWriteTime){
  UINT64 *v6; 
  int v11; 
  ULONG Length; 
  VOID *PoolWithTag; 
  VOID *v14; 
  NTSTATUS v15; 
  ULONG v17; 
  ULONG ResultLength; 
  v6 = KeyValueLength;
  if( !KeyValue )
  {
    if( !KeyValueLength )
    {
      v11 = 0;
LABEL_4:
      ResultLength = 0;
      Length = v11 + 12;
      if( Length )
      {
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, Length, 0x72746C6Dui64);
        v14 = PoolWithTag;
        if( PoolWithTag )
          memset((INT64)PoolWithTag, 0i64);
      }
      else
      {
        v14 = 0i64;
      }
      if( !v14 )
        return(unsigned int)-1073741670;
      v15 = ZwQueryValueKey(KeyHandle, KeyValueName, KeyValuePartialInformation, v14, Length, &ResultLength);
      if( v15 != -1073741772 )
      {
        if( v15 < 0 )
        {
LABEL_10:
          if( v15 != -2147483643 )
          {
LABEL_11:
            ExFreePoolWithTag(v14, 0);
            return(unsigned int)v15;
          }
LABEL_21:
          if( v6 )
            *(_DWORD *)v6 = *((_DWORD *)v14 + 2);
          if( KeyValueType )
            *(_DWORD *)KeyValueType = *((_DWORD *)v14 + 1);
          goto LABEL_11;
        }
        if( KeyValue && v6 )
        {
          v17 = *((_DWORD *)v14 + 2);
          if( v17 > *(_DWORD *)v6 )
          {
            v15 = -2147483643;
            goto LABEL_21;
          }
          if( v17 <= Length )
            memmove((UINT8 *)KeyValue, (UINT8 *)v14 + 12, v17);
        }
      }
      if( v15 >= 0 )
        goto LABEL_21;
      goto LABEL_10;
    }
LABEL_3:
    v11 = *(_DWORD *)KeyValueLength;
    goto LABEL_4;
  }
  if( KeyValueLength )
    goto LABEL_3;
  return 3221225485i64;
}

Referenced by: