FsRtlpQueryValueKey

NTSTATUS __stdcall FsRtlpQueryValueKey(
        _UNICODE_STRING *KeyName,
        _UNICODE_STRING *ValueName,
        UINT64 *ValueLength,
        PVOID *KeyValueInformation,
        UINT8 *DeallocateKeyValue,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  NTSTATUS result; 
  int v12; 
  VOID *PoolWithTag; 
  UINT8 *i; 
  NTSTATUS v15; 
  NTSTATUS v16; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 NumberOfBytes; 

  LODWORD(NumberOfBytes) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = KeyName;
  ObjectAttributes.Attributes = 576;
  result = ZwOpenKey(
             &KeyHandle,
             0x20019ui64,
             &ObjectAttributes,
             (INT64)KeyValueInformation,
             Length,
             (INT64)ResultLength,
             0i64,
             48i64);
  if( result >= 0 )
  {
    if( ValueName )
    {
      v12 = *(_DWORD *)ValueLength;
      PoolWithTag = *KeyValueInformation;
      for( i = DeallocateKeyValue; ; *i = 1 )
      {
        LODWORD(Lengtha) = v12;
        v15 = ZwQueryValueKey(KeyHandle, ValueName, KeyValueFullInformation, PoolWithTag, Lengtha, &NumberOfBytes);
        v16 = v15;
        if( v15 != -1073741789 && v15 != -2147483643 )
          break;
        if( v12 != *(_DWORD *)ValueLength )
          break;
        v12 = NumberOfBytes;
        PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1752453958i64);
        if( !PoolWithTag )
        {
          v16 = -1073741670;
          break;
        }
        if( *i )
          ExFreePoolWithTag(*KeyValueInformation, 0);
        *KeyValueInformation = PoolWithTag;
        *(_DWORD *)ValueLength = v12;
      }
      ZwClose((_HANDLE)KeyHandle);
      if( v16 >= 0 && !*((_DWORD *)*KeyValueInformation + 3) )
        return -1073741772;
      return v16;
    }
    else
    {
      ZwClose((_HANDLE)KeyHandle);
      return 0;
    }
  }
  return result;
}

Referenced by: