KsepRegistryQuerySZ

NTSTATUS __stdcall KsepRegistryQuerySZ(_HANDLE KeyHandle, PCWSTR SourceString, INT64 a3, INT64 a4){
  VOID *v4; 
  int v6; 
  _QWORD *v8; 
  int v9; 
  _DWORD *Paged; 
  _DWORD *v11; 
  NTSTATUS v12; 
  unsigned __int64 v13; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  char v18; 
  __int64 v19; 
  UINT64 Length; 
  UINT64 Lengtha; 
  _UNICODE_STRING DestinationString; 
  UINT64 Size; 
  unsigned __int64 v24; 
  _QWORD *v25; 

  LODWORD(Size) = 0;
  v4 = *(VOID **)&KeyHandle;
  v6 = a3;
  DestinationString = 0i64;
  if( !*(_QWORD *)&KeyHandle )
  {
    v15 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v15 + 1] = -1073740768;
    KsepHistoryErrors[2 * v15] = 262993;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("KeyHandle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 849i64, 0i64);
  }
  if( !a4 )
  {
    v16 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v16 + 1] = -1073740768;
    KsepHistoryErrors[2 * v16] = 262994;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ValueBuffer != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 850i64, 0i64);
  }
  v8 = v25;
  if( !v25 )
  {
    v17 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v17 + 1] = -1073740768;
    KsepHistoryErrors[2 * v17] = 262995;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ActualLength != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 851i64, 0i64);
  }
  RtlInitUnicodeString(&DestinationString, SourceString);
  LODWORD(Length) = 0;
  v9 = ZwQueryValueKey(v4, &DestinationString, KeyValuePartialInformation, 0i64, Length, &Size);
  if( v9 == -1073741789 )
  {
    Paged = KsepPoolAllocatePaged((unsigned int)Size);
    v11 = Paged;
    if( Paged )
    {
      LODWORD(Lengtha) = Size;
      v12 = ZwQueryValueKey(v4, &DestinationString, KeyValuePartialInformation, Paged, Lengtha, &Size);
      if( !v12 )
      {
        v13 = (unsigned int)v11[2];
        if( v13 > v24 )
        {
          v12 = -1073741789;
        }
        else if( v11[1] == v6 )
        {
          memmove((VOID *)a4, v11 + 3, v13);
          *v8 = (unsigned int)v11[2];
        }
        else
        {
          v12 = -1073741788;
        }
      }
      KsepPoolFreePaged(v11);
      return v12;
    }
    else
    {
      return -1073741801;
    }
  }
  else
  {
    if( v9 >= 0 )
    {
      v18 = KsepDebugFlag;
      v19 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      KsepHistoryErrors[2 * v19 + 1] = -1073740768;
      KsepHistoryErrors[2 * v19] = 263013;
      if( (v18 & 4) != 0 )
        RtlAssert("!NT_SUCCESS(Status)", "minkernel\\ntos\\kshim\\kseregistry.c", 869i64, 0i64);
    }
    return v9;
  }
}

Referenced by: