TtmpGetConfigOverride

char __fastcall TtmpGetConfigOverride(__int64 a1, const WCHAR *a2, _DWORD *a3){
  INT64 v5; 
  NTSTATUS v6; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v11; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING ValueName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LODWORD(v11) = 0;
  DestinationString = 0i64;
  ValueName = 0i64;
  KeyValueInformation = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Power");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v5, Length, (INT64)ResultLength, v11, 0i64) >= 0
    && (RtlInitUnicodeString(&ValueName, a2),
        LODWORD(Lengtha) = 16,
        v6 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v11),
        ZwClose((_HANDLE)KeyHandle),
        v6 >= 0)
    && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
  {
    *a3 = HIDWORD(KeyValueInformation);
    return 1;
  }
  else
  {
    *a3 = 0;
    return 0;
  }
}

Referenced by: