WmipGetRegistryHideMachine

UINT8 __stdcall WmipGetRegistryHideMachine(){
  int v0; 
  INT64 v1; 
  VOID **PoolWithTag; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 Lengthb; 
  UINT64 *ResultLength; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 NumberOfBytes; 
  VOID *KeyHandle; 

  LODWORD(NumberOfBytes) = 0;
  v0 = 0;
  KeyHandle = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(
    &DestinationString,
    L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Restrictions");
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  if( ZwOpenKey(
         &KeyHandle,
         0x20019ui64,
         &ObjectAttributes,
         v1,
         Length,
         (INT64)ResultLength,
         *(INT64 *)&DestinationString.Length,
         (INT64)DestinationString.Buffer) >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"HideMachine");
    LODWORD(Lengtha) = 0;
    if( ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, 0i64, Lengtha, &NumberOfBytes) == -1073741789 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1885957463i64);
      if( PoolWithTag )
      {
        LODWORD(Lengthb) = NumberOfBytes;
        if( ZwQueryValueKey(
               KeyHandle,
               &DestinationString,
               KeyValuePartialInformation,
               PoolWithTag,
               Lengthb,
               &NumberOfBytes) >= 0
          && *((_DWORD *)PoolWithTag + 1) == 4
          && *((_DWORD *)PoolWithTag + 2) == 4 )
        {
          v0 = *((_DWORD *)PoolWithTag + 3);
        }
        ExFreePoolWithTag(PoolWithTag, 0);
      }
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v0 != 0;
}

Referenced by: