KsepRegistryQuerySZ

VOID __fastcall KsepRegistryQuerySZ(UINT64 a1, INT8 *a2, UINT64 a3, INT8 *a4){
  int v6; 
  _QWORD *v8; 
  NTSTATUS v9; 
  UINT8 *v10; 
  UINT8 *v11; 
  UINT64 v12; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  char v16; 
  __int64 v17; 
  struct _UNICODE_STRING DestinationString; 
  ULONG ResultLength; 
  __int64 v20; 
  __int64 v21; 
  ResultLength = 0;
  v6 = a3;
  DestinationString = 0i64;
  if( !a1 )
  {
    LOWORD(a3) = 849;
    v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v13 + 1] = -1073740768;
    KsepHistoryErrors[2 * v13] = 262993;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("KeyHandle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x351u, 0i64);
  }
  if( !a4 )
  {
    LOWORD(a3) = 850;
    v14 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v14 + 1] = -1073740768;
    KsepHistoryErrors[2 * v14] = 262994;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ValueBuffer != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x352u, 0i64);
  }
  v8 = (_QWORD *)v21;
  if( !v21 )
  {
    v15 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    LOWORD(a3) = 851;
    KsepHistoryErrors[2 * v15 + 1] = -1073740768;
    KsepHistoryErrors[2 * v15] = 262995;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("ActualLength != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x353u, 0i64);
  }
  RtlInitUnicodeString(&DestinationString, (PCWSTR)a2, a3);
  v9 = ZwQueryValueKey((HANDLE)a1, &DestinationString, KeyValuePartialInformation, 0i64, 0, &ResultLength);
  if( v9 == -1073741789 )
  {
    KsepPoolAllocatePaged(ResultLength);
    v11 = v10;
    if( v10 )
    {
      if( !ZwQueryValueKey(
              (HANDLE)a1,
              &DestinationString,
              KeyValuePartialInformation,
              v10,
              ResultLength,
              &ResultLength) )
      {
        v12 = *((unsigned int *)v11 + 2);
        if( v12 <= v20 && *((_DWORD *)v11 + 1) == v6 )
        {
          memmove((UINT8 *)a4, v11 + 12, v12);
          *v8 = *((unsigned int *)v11 + 2);
        }
      }
      KsepPoolFreePaged(v11);
    }
  }
  else if( v9 >= 0 )
  {
    v16 = KsepDebugFlag;
    v17 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v17 + 1] = -1073740768;
    KsepHistoryErrors[2 * v17] = 263013;
    if( (v16 & 4) != 0 )
      RtlAssert("!NT_SUCCESS(Status)", "minkernel\\ntos\\kshim\\kseregistry.c", 0x365u, 0i64);
  }
}

Referenced by: