RtlQueryImageFileKeyOption

INT64 __fastcall RtlQueryImageFileKeyOption(
        VOID *KeyHandle,
        const WCHAR *OptionName,
        UINT64 Type,
        VOID *Buffer,
        UINT64 BufferSize,
        UINT64 *ResultSize){
  int v8; 
  INT64 result; 
  unsigned int v10; 
  __int128 *p_KeyValueInformation; 
  unsigned int v12; 
  ULONG Length; 
  UINT64 i; 
  void *PoolWithQuotaTag; 
  void *v16; 
  NTSTATUS v17; 
  int v18; 
  UINT64 v19; 
  ULONG ResultLength; 
  struct _UNICODE_STRING DestinationString; 
  UINT64 *v22; 
  __int128 KeyValueInformation; 
  int v24; 
  v22 = ResultSize;
  ResultLength = 0;
  v24 = 0;
  v8 = Type;
  DestinationString = 0i64;
  KeyValueInformation = 0i64;
  result = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)OptionName);
  if( (int)result < 0 )
    return result;
  v10 = BufferSize;
  if( (unsigned int)BufferSize < 8 )
  {
    p_KeyValueInformation = &KeyValueInformation;
    LODWORD(result) = ZwQueryValueKey(
                        KeyHandle,
                        &DestinationString,
                        KeyValuePartialInformation,
                        &KeyValueInformation,
                        0x14u,
                        &ResultLength);
    v12 = result;
    if( (int)result < 0 )
    {
      if( (_DWORD)result != -2147483643 )
        return result;
      Length = ResultLength;
      goto LABEL_7;
    }
    v16 = 0i64;
LABEL_15:
    if( !v8 )
    {
      if( *((_DWORD *)p_KeyValueInformation + 2) > (unsigned int)BufferSize )
      {
        ResultLength = *((_DWORD *)p_KeyValueInformation + 2);
        goto LABEL_54;
      }
      v8 = *((_DWORD *)p_KeyValueInformation + 1);
      v10 = *((_DWORD *)p_KeyValueInformation + 2);
    }
    v18 = *((_DWORD *)p_KeyValueInformation + 1);
    if( ((v18 - 3) & 0xFFFFFFFB) != 0 )
    {
      if( v18 == 4 )
      {
        if( v8 == 4 )
        {
          if( v10 == 4 && *((_DWORD *)p_KeyValueInformation + 2) == 4 )
          {
            ResultLength = 4;
            if( Buffer )
            {
              *(_DWORD *)Buffer = *((_DWORD *)p_KeyValueInformation + 3);
LABEL_23:
              if( v22 && ((int)(v12 + 0x80000000) < 0 || v12 == -2147483643) )
                *(_DWORD *)v22 = ResultLength;
              goto LABEL_11;
            }
            goto LABEL_54;
          }
          goto LABEL_37;
        }
LABEL_55:
        v12 = -1073741788;
        goto LABEL_11;
      }
      if( v18 == 11 )
      {
        if( v8 == 11 )
        {
          if( v10 == 8 && *((_DWORD *)p_KeyValueInformation + 2) == 8 )
          {
            ResultLength = 8;
            if( Buffer )
            {
              *(_QWORD *)Buffer = *(_QWORD *)((char *)p_KeyValueInformation + 12);
              goto LABEL_23;
            }
LABEL_54:
            v12 = -2147483643;
            goto LABEL_23;
          }
          goto LABEL_37;
        }
        goto LABEL_55;
      }
      if( v18 != 1 )
      {
        v12 = -1073741788;
        goto LABEL_23;
      }
      if( v8 == 4 )
      {
        if( v10 == 4 )
        {
          if( ((unsigned __int8)Buffer & 3) == 0 )
          {
            ResultLength = 4;
            if( Buffer )
            {
              DestinationString.Buffer = (wchar_t *)p_KeyValueInformation + 6;
              DestinationString.Length = *((_WORD *)p_KeyValueInformation + 4);
              DestinationString.MaximumLength = *((_WORD *)p_KeyValueInformation + 4);
              v12 = RtlUnicodeStringToInteger(&DestinationString, 0i64, (UINT64 *)Buffer);
              goto LABEL_23;
            }
            goto LABEL_54;
          }
          v12 = -2147483646;
LABEL_11:
          if( v16 )
            ExFreePoolWithTag(v16, 0);
          return v12;
        }
LABEL_37:
        v12 = -1073741820;
        goto LABEL_11;
      }
      v19 = *((unsigned int *)p_KeyValueInformation + 2);
      ResultLength = *((_DWORD *)p_KeyValueInformation + 2);
    }
    else
    {
      if( v8 != v18 )
        goto LABEL_55;
      ResultLength = *((_DWORD *)p_KeyValueInformation + 2);
      if( !Buffer )
        goto LABEL_54;
      v19 = *((unsigned int *)p_KeyValueInformation + 2);
    }
    if( (unsigned int)v19 <= v10 )
    {
      memmove((UINT8 *)Buffer, (UINT8 *)p_KeyValueInformation + 12, v19);
      goto LABEL_23;
    }
    goto LABEL_54;
  }
  Length = BufferSize + 12;
LABEL_7:
  for( i = Length; ; i = ResultLength )
  {
    PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, i, 0x6B497452ui64);
    v16 = PoolWithQuotaTag;
    if( !PoolWithQuotaTag )
      break;
    p_KeyValueInformation = (__int128 *)PoolWithQuotaTag;
    v17 = ZwQueryValueKey(
            KeyHandle,
            &DestinationString,
            KeyValuePartialInformation,
            PoolWithQuotaTag,
            Length,
            &ResultLength);
    v12 = v17;
    if( v17 >= 0 )
      goto LABEL_15;
    if( v17 != -2147483643 )
      goto LABEL_11;
    ExFreePoolWithTag(v16, 0);
    Length = ResultLength;
  }
  return 3221225495i64;
}

Referenced by: