SiGetRegistryValue

NTSTATUS __stdcall SiGetRegistryValue(PWCHAR ValueName, PWCHAR KeyName, PVOID *Buffer, UINT64 *a4){
  VOID ***v4; 
  _DWORD *v5; 
  VOID **v6; 
  VOID *v7; 
  WCHAR *v9; 
  NTSTATUS v10; 
  int v11; 
  NTSTATUS v12; 
  VOID **PoolWithTag; 
  VOID **v14; 
  UINT64 Length; 
  UINT64 Lengtha; 
  _UNICODE_STRING DestinationString; 
  UINT64 ResultLength; 
  VOID *Handle; 
  UINT64 NumberOfBytes; 
  VOID ***v22; 
  _DWORD *v23; 

  HIDWORD(ResultLength) = HIDWORD(ValueName);
  v4 = v22;
  v5 = v23;
  LODWORD(ResultLength) = 0;
  v6 = 0i64;
  LODWORD(NumberOfBytes) = 0;
  v7 = 0i64;
  *v22 = 0i64;
  *v5 = 0;
  DestinationString = 0i64;
  Handle = 0i64;
  RtlInitUnicodeString(&DestinationString, KeyName);
  if( !Buffer || (v10 = SiOpenRegistryKey(v9, Buffer), v7 = Handle, v11 = v10, v10 >= 0) )
  {
    LODWORD(Length) = 0;
    v12 = ZwQueryValueKey(v7, &DestinationString, KeyValuePartialInformation, 0i64, Length, &NumberOfBytes);
    v11 = v12;
    if( v12 == -1073741789 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1263556947i64);
      v6 = PoolWithTag;
      if( !PoolWithTag )
      {
LABEL_16:
        v11 = -1073741670;
        goto LABEL_9;
      }
      LODWORD(Lengtha) = NumberOfBytes;
      v11 = ZwQueryValueKey(v7, &DestinationString, KeyValuePartialInformation, PoolWithTag, Lengtha, &ResultLength);
      if( v11 < 0 )
        goto LABEL_9;
      if( *((_DWORD *)v6 + 1) == 1 )
      {
        LODWORD(NumberOfBytes) = NumberOfBytes - 12;
        v14 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1263556947i64);
        *v4 = v14;
        if( v14 )
        {
          memmove(v14, (char *)v6 + 12, NumberOfBytes);
          v11 = 0;
          *v5 = NumberOfBytes;
          goto LABEL_9;
        }
        goto LABEL_16;
      }
      v11 = -1073741788;
    }
    else if( v12 >= 0 )
    {
      v11 = -1073741823;
    }
  }
LABEL_9:
  if( v7 )
    ZwClose((_HANDLE)v7);
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  return v11;
}

Referenced by: