KsepRegistryQueryValue

VOID __fastcall KsepRegistryQueryValue(VOID *KeyHandle, WCHAR *ValueName){
  _DWORD *v2; 
  VOID *v3; 
  VOID *v5; 
  _DWORD *v6; 
  __int64 v8; 
  __int64 v9; 
  unsigned __int64 *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  char v13; 
  __int64 v14; 
  _DWORD *Paged; 
  _DWORD *v16; 
  unsigned __int64 v17; 
  UINT64 Length; 
  UINT64 Lengtha; 
  _UNICODE_STRING DestinationString; 
  UINT64 Size; 
  unsigned __int64 v22; 
  unsigned __int64 *v23; 

  LODWORD(Size) = 0;
  v5 = v3;
  v6 = v2;
  DestinationString = 0i64;
  if( !KeyHandle )
  {
    v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v8 + 1] = -1073740768;
    KsepHistoryErrors[2 * v8] = 263113;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("KeyHandle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 969i64, 0i64);
  }
  if( !v5 )
  {
    v9 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v9 + 1] = -1073740768;
    KsepHistoryErrors[2 * v9] = 263114;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ValueBuffer != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 970i64, 0i64);
  }
  v10 = v23;
  if( !v23 )
  {
    v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v11 + 1] = -1073740768;
    KsepHistoryErrors[2 * v11] = 263115;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ActualLength != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 971i64, 0i64);
  }
  RtlInitUnicodeString(&DestinationString, ValueName);
  LODWORD(Length) = 0;
  v12 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, 0i64, Length, &Size);
  if( v12 == -1073741789 )
  {
    Paged = KsepPoolAllocatePaged((unsigned int)Size);
    v16 = Paged;
    if( Paged )
    {
      LODWORD(Lengtha) = Size;
      if( !ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, Paged, Lengtha, &Size) )
      {
        v17 = (unsigned int)v16[2];
        if( v17 <= v22 )
        {
          memmove(v5, v16 + 3, v17);
          *v6 = v16[1];
          *v10 = (unsigned int)v16[2];
        }
        else
        {
          *v10 = v17;
        }
      }
      KsepPoolFreePaged(v16);
    }
  }
  else if( v12 >= 0 )
  {
    v13 = KsepDebugFlag;
    v14 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v14 + 1] = -1073740768;
    KsepHistoryErrors[2 * v14] = 263133;
    if( (v13 & 4) != 0 )
      RtlAssert("!NT_SUCCESS(Status)", "minkernel\\ntos\\kshim\\kseregistry.c", 989i64, 0i64);
  }
}

Referenced by: