LdrpQueryValueKey

NTSTATUS __stdcall LdrpQueryValueKey(
        VOID *KeyHandle,
        _UNICODE_STRING *KeyValueName,
        UINT64 *KeyValueType,
        VOID *KeyValue,
        UINT64 *KeyValueLength){
  UINT64 *v5; 
  int v10; 
  size_t v11; 
  VOID **PoolWithTag; 
  VOID **v13; 
  int v14; 
  size_t v16; 
  UINT64 Length; 
  UINT64 ResultLength; 

  v5 = KeyValueLength;
  if( !KeyValue )
  {
    if( !KeyValueLength )
    {
      v10 = 0;
LABEL_4:
      LODWORD(ResultLength) = 0;
      v11 = v10 + 12;
      if( v11 )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, v11, 1920232557i64);
        v13 = PoolWithTag;
        if( PoolWithTag )
          memset(PoolWithTag, 0i64, v11);
      }
      else
      {
        v13 = 0i64;
      }
      if( !v13 )
        return -1073741670;
      LODWORD(Length) = v11;
      v14 = ZwQueryValueKey(KeyHandle, KeyValueName, KeyValuePartialInformation, v13, Length, &ResultLength);
      if( v14 != -1073741772 )
      {
        if( v14 < 0 )
        {
LABEL_10:
          if( v14 != -2147483643 )
          {
LABEL_11:
            ExFreePoolWithTag(v13, 0);
            return v14;
          }
LABEL_21:
          if( v5 )
            *(_DWORD *)v5 = *((_DWORD *)v13 + 2);
          if( KeyValueType )
            *(_DWORD *)KeyValueType = *((_DWORD *)v13 + 1);
          goto LABEL_11;
        }
        if( KeyValue && v5 )
        {
          v16 = *((_DWORD *)v13 + 2);
          if( v16 > *(_DWORD *)v5 )
          {
            v14 = -2147483643;
            goto LABEL_21;
          }
          if( v16 <= v11 )
            memmove(KeyValue, (char *)v13 + 12, v16);
        }
      }
      if( v14 >= 0 )
        goto LABEL_21;
      goto LABEL_10;
    }
LABEL_3:
    v10 = *(_DWORD *)KeyValueLength;
    goto LABEL_4;
  }
  if( KeyValueLength )
    goto LABEL_3;
  return -1073741811;
}

Referenced by: