IopGetRegistryValue

NTSTATUS __stdcall IopGetRegistryValue(
        PVOID KeyHandle,
        PWCHAR ValueName,
        UINT64 GuessSize,
        _KEY_VALUE_FULL_INFORMATION **Information){
  int v6; 
  NTSTATUS result; 
  __int64 v9; 
  int v10; 
  unsigned int v11; 
  _KEY_VALUE_FULL_INFORMATION *Pool_1; 
  int v13; 
  _KEY_VALUE_FULL_INFORMATION *v14; 
  int v15; 
  UINT64 Length; 
  UINT64 Lengtha; 
  UINT64 ResultLength; 
  _UNICODE_STRING ValueNamea[2]; 

  ValueNamea[0] = 0i64;
  LODWORD(ResultLength) = 0;
  v6 = GuessSize;
  result = RtlInitUnicodeStringEx(ValueNamea, ValueName);
  if( result >= 0 )
  {
    v9 = -1i64;
    do
      ++v9;
    while( ValueName[v9] );
    v10 = (2 * v9 + 31) & 0xFFFFFFF8;
    if( v6 )
      v11 = (v6 + v10 + 7) & 0xFFFFFFF8;
    else
      v11 = v10 + 4;
    Pool_1 = (_KEY_VALUE_FULL_INFORMATION *)IopVerifierExAllocatePool_1(1ui64, v11);
    if( Pool_1 )
    {
      LODWORD(Length) = v11;
      v13 = ZwQueryValueKey(KeyHandle, ValueNamea, KeyValueFullInformation, Pool_1, Length, &ResultLength);
      if( v13 >= 0 )
      {
        *Information = Pool_1;
        return 0;
      }
      ExFreePoolWithTag(Pool_1, 0);
      if( v13 != -2147483643 && v13 != -1073741789 )
        return v13;
      v14 = (_KEY_VALUE_FULL_INFORMATION *)IopVerifierExAllocatePool_1(1ui64, (unsigned int)ResultLength);
      if( v14 )
      {
        LODWORD(Lengtha) = ResultLength;
        v15 = ZwQueryValueKey(KeyHandle, ValueNamea, KeyValueFullInformation, v14, Lengtha, &ResultLength);
        if( v15 < 0 )
        {
          ExFreePoolWithTag(v14, 0);
          return v15;
        }
        *Information = v14;
        return 0;
      }
    }
    return -1073741670;
  }
  return result;
}

Referenced by: