RegRtlQueryValue

__int64 __fastcall RegRtlQueryValue(HANDLE KeyHandle, const WCHAR *a2, _DWORD *a3, void *a4, __int64 a5){
  void *v6; 
  int inited; 
  char *p_KeyValueInformation; 
  ULONG Length; 
  NTSTATUS v12; 
  unsigned int v13; 
  unsigned int v14; 
  VOID *PoolWithTag; 
  ULONG ResultLength; 
  struct _UNICODE_STRING DestinationString; 
  char KeyValueInformation; 
  v6 = 0i64;
  ResultLength = 0;
  DestinationString = 0i64;
  inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)a2);
  if( inited >= 0 )
  {
    if( a4 && *(_DWORD *)a5 > 0x80u )
    {
      Length = *(_DWORD *)a5 + 12;
      if( Length < 0xC )
        return(unsigned int)-1073741675;
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, Length, 0x4C474552ui64);
      v6 = PoolWithTag;
      if( !PoolWithTag )
        return(unsigned int)-1073741801;
      p_KeyValueInformation = (char *)PoolWithTag;
    }
    else
    {
      p_KeyValueInformation = &KeyValueInformation;
      Length = 140;
    }
    v12 = ZwQueryValueKey(
            KeyHandle,
            &DestinationString,
            KeyValuePartialInformation,
            p_KeyValueInformation,
            Length,
            &ResultLength);
    inited = v12;
    if( !v12 || v12 == -2147483643 )
    {
      v13 = *(_DWORD *)a5;
      v14 = *((_DWORD *)p_KeyValueInformation + 2);
      *(_DWORD *)a5 = v14;
      if( v13 < v14 )
        inited = -1073741789;
      else
        memmove((UINT8 *)a4, (UINT8 *)p_KeyValueInformation + 12, *((unsigned int *)p_KeyValueInformation + 2));
      if( a3 )
        *a3 = *((_DWORD *)p_KeyValueInformation + 1);
    }
    if( v6 )
      ExFreePoolWithTag(v6, 0);
  }
  return(unsigned int)inited;
}

Referenced by: