FsRtlGetCompatibilityModeValue

NTSTATUS __stdcall FsRtlGetCompatibilityModeValue(UNICODE_STRING *ValueName, UINT64 *Value){
  NTSTATUS result; 
  ULONG Length; 
  unsigned int *v6; 
  char *i; 
  int v8; 
  char *PoolWithTag; 
  ULONG ResultLength; 
  void *KeyHandle; 
  int v12[2]; 
  const wchar_t *v13; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[96]; 
  KeyHandle = 0i64;
  ResultLength = 0;
  v12[1] = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  v13 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem";
  v12[0] = 8126586;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v12;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  result = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( result >= 0 )
  {
    Length = 92;
    v6 = (unsigned int *)KeyValueInformation;
    for( i = KeyValueInformation; ; i = PoolWithTag )
    {
      v8 = ZwQueryValueKey(KeyHandle, ValueName, KeyValueFullInformation, i, Length, &ResultLength);
      if( v8 != -2147483643 )
        break;
      if( v6 != (unsigned int *)KeyValueInformation )
        ExFreePoolWithTag(v6, 0);
      Length += 256;
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, Length, 0x20746146ui64);
      v6 = (unsigned int *)PoolWithTag;
      if( !PoolWithTag )
        return -1073741801;
    }
    ZwClose(KeyHandle);
    if( v8 >= 0 )
    {
      if( v6[3] )
        *(_DWORD *)Value = *(unsigned int *)((char *)v6 + v6[2]);
      else
        v8 = -1073741772;
    }
    if( v6 != (unsigned int *)KeyValueInformation )
      ExFreePoolWithTag(v6, 0);
    return v8;
  }
  return result;
}

Referenced by: