PopGetBitlockerKeyLocation

NTSTATUS __stdcall PopGetBitlockerKeyLocation(_LARGE_INTEGER *BitlockerPA){
  VOID **PoolWithTag; 
  INT64 v3; 
  int v4; 
  int v5; 
  WORD *v6; 
  WORD *v8; 
  LONGLONG v9; 
  WORD v10; 
  WORD v11; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 Lengthb; 
  UINT64 *ResultLength; 
  UINT64 v16; 
  VOID *KeyHandle; 
  _UNICODE_STRING ValueName; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  PoolWithTag = 0i64;
  LODWORD(v16) = 0;
  DestinationString = 0i64;
  KeyValueInformation = 0i64;
  ValueName = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v3, Length, (INT64)ResultLength, v16, 0i64);
  if( v4 >= 0 )
  {
    RtlInitUnicodeString(&ValueName, L"SystemStartOptions");
    LODWORD(Lengtha) = 16;
    v4 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v16);
    if( (int)(v4 + 0x80000000) < 0 || v4 == -2147483643 )
    {
      if( DWORD1(KeyValueInformation) != 1 )
      {
        v4 = -1073741811;
        goto LABEL_11;
      }
      v5 = v16;
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)v16 + 2i64, 1718968931i64);
      if( !PoolWithTag )
      {
        v4 = -1073741801;
        goto LABEL_11;
      }
      LODWORD(Lengthb) = v5;
      v4 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, PoolWithTag, Lengthb, &v16);
    }
    if( v4 >= 0 )
    {
      *(_WORD *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2) + 12) = 0;
      v6 = wcsstr((WORD *)PoolWithTag + 6, (INT8 *)L"FVEBOOT=");
      if( !v6 )
        goto LABEL_8;
      v8 = v6 + 8;
      v9 = 0i64;
      v10 = v6[8];
      if( v10 >= 0x30u )
      {
        v11 = v10;
        do
        {
          v10 = v11;
          if( v11 > 0x39u )
            break;
          ++v8;
          v9 = v11 + 2 * (5 * v9 - 24);
          v10 = *v8;
          v11 = *v8;
        }
        while( *v8 >= 0x30u );
      }
      if( (v10 & 0xFFDF) != 0 )
LABEL_8:
        v4 = -1073741823;
      else
        BitlockerPA->QuadPart = v9;
    }
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0x66756263u);
  }
LABEL_11:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v4;
}

Referenced by: