CcQueryRegKeyValue

UINT32 __stdcall CcQueryRegKeyValue(UINT64 a1, INT64 a2){
  int *v2; 
  INT64 v3; 
  int *v4; 
  PVOID *v6; 
  UINT32 result; 
  int v8; 
  VOID **PoolWithTag; 
  _BYTE *i; 
  NTSTATUS v11; 
  signed __int32 v12; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 NumberOfBytes; 
  _BYTE *v19; 

  v4 = v2;
  LODWORD(NumberOfBytes) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)a1;
  v6 = (PVOID *)v3;
  ObjectAttributes.Attributes = 576;
  result = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v3, Length, (INT64)ResultLength, 0i64, 48i64);
  if( (result & 0x80000000) == 0 )
  {
    if( a2 )
    {
      v8 = *v4;
      PoolWithTag = (VOID **)*v6;
      for( i = v19; ; *i = 1 )
      {
        LODWORD(Lengtha) = v8;
        v11 = ZwQueryValueKey(
                KeyHandle,
                (_UNICODE_STRING *)a2,
                KeyValueFullInformation,
                PoolWithTag,
                Lengtha,
                &NumberOfBytes);
        v12 = v11;
        if( v11 != -1073741789 && v11 != -2147483643 )
          break;
        if( v8 != *v4 )
          break;
        v8 = NumberOfBytes;
        if( (unsigned int)NumberOfBytes > 0x40000
          || (PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 2019976003i64)) == 0i64 )
        {
          v12 = -1073741670;
          break;
        }
        if( *i )
          ExFreePoolWithTag(*v6, 0x78666343u);
        *v6 = PoolWithTag;
        *v4 = v8;
      }
      ZwClose((_HANDLE)KeyHandle);
      if( v12 >= 0 && !*((_DWORD *)*v6 + 3) )
        return -1073741772;
      return v12;
    }
    else
    {
      ZwClose((_HANDLE)KeyHandle);
      return 0;
    }
  }
  return result;
}

Referenced by: