NtQueryLicenseValue

NTSTATUS __stdcall NtQueryLicenseValue(
        _UNICODE_STRING *ValueName,
        UINT64 *Type,
        VOID *Data,
        UINT64 DataSize,
        UINT64 *ResultDataSize){
  UINT64 v5; 
  int v8; 
  char PreviousMode; 
  UINT64 *v10; 
  int v11; 
  unsigned __int64 Buffer; 
  unsigned __int64 v13; 
  VOID **PoolWithTag; 
  VOID **v15; 
  __int64 v16; 
  struct _EXP_LICENSE_STATE *ExpLicenseState; 
  NTSTATUS v18; 
  int v19; 
  unsigned int v20; 
  UINT64 v22; 
  size_t Size; 
  PVOID v24; 
  PVOID P; 
  VOID *Src[10]; 
  INT64 v27; 
  UINT64 *v28; 
  VOID *v29; 
  int v30; 

  v30 = DataSize;
  v29 = Data;
  v28 = Type;
  v5 = (unsigned int)DataSize;
  *(_OWORD *)Src = 0i64;
  v8 = 0;
  P = 0i64;
  LODWORD(v27) = 0;
  v24 = 0i64;
  Size = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( ValueName && (v10 = ResultDataSize) != 0i64 && (Data || !(_DWORD)DataSize) )
  {
    if( (unsigned int)DataSize > 0x800000 )
    {
      v8 = -1073741801;
    }
    else if( PreviousMode )
    {
      if( (unsigned __int64)ValueName >= 0x7FFFFFFF0000i64 )
        ValueName = (_UNICODE_STRING *)0x7FFFFFFF0000i64;
      v11 = *(_DWORD *)&ValueName->Length;
      LODWORD(Src[0]) = *(_DWORD *)&ValueName->Length;
      Buffer = (unsigned __int64)ValueName->Buffer;
      Src[1] = (VOID *)Buffer;
      if( Buffer && (_WORD)v11 && (v11 & 1) == 0 )
      {
        if( (Buffer & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v13 = Buffer + (unsigned __int16)v11;
        if( v13 > 0x7FFFFFFF0000i64 || v13 < Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
        PoolWithTag = ExAllocatePoolWithTag(1ui64, LOWORD(Src[0]), 542329939i64);
        P = PoolWithTag;
        if( PoolWithTag )
        {
          v15 = PoolWithTag;
          memmove(PoolWithTag, Src[1], LOWORD(Src[0]));
          Src[1] = v15;
          if( Type )
          {
            v16 = (__int64)Type;
            if( (unsigned __int64)Type >= 0x7FFFFFFF0000i64 )
              v16 = 0x7FFFFFFF0000i64;
            *(_DWORD *)v16 = *(_DWORD *)v16;
            LODWORD(v27) = *(_DWORD *)Type;
          }
          if( Data
            && (_DWORD)v5
            && (ProbeForWrite((UINT64)Data, v5, 1i64), (v24 = ExAllocatePoolWithTag(1ui64, v5, 542329939i64)) == 0i64) )
          {
            v8 = -1073741801;
          }
          else
          {
            Buffer = (unsigned __int64)v10;
            if( (unsigned __int64)v10 >= 0x7FFFFFFF0000i64 )
              Buffer = 0x7FFFFFFF0000i64;
            *(_DWORD *)Buffer = *(_DWORD *)Buffer;
            Size = *(_DWORD *)v10;
          }
        }
        else
        {
          v8 = -1073741801;
        }
      }
      else
      {
        v8 = -1073741811;
      }
      if( v8 >= 0 )
      {
        ExpLicenseState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)Buffer)->ExpLicenseState;
        if( qword_140D2C500 )
        {
          v18 = qword_140D2C500(ExpLicenseState, Src, &v27, v24, v5, &Size);
        }
        else
        {
          LODWORD(v22) = v5;
          v18 = SLQueryLicenseValueInternal(
                  (INT64)ExpLicenseState,
                  (const _UNICODE_STRING *)Src,
                  (INT64)&v27,
                  v24,
                  v22,
                  (UINT64 *)&Size);
        }
        v19 = v18;
        v8 = v18;
        if( Type )
          *(_DWORD *)Type = v27;
        v20 = Size;
        *(_DWORD *)v10 = Size;
        if( v19 >= 0 && Data )
        {
          if( (unsigned int)v5 < v20 )
            v8 = -1073741789;
          else
            memmove(Data, v24, v20);
        }
      }
    }
    else
    {
      v8 = ntoskrnl_27(ValueName, (INT64)Type, Data, DataSize, ResultDataSize);
    }
  }
  else
  {
    v8 = -1073741811;
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v24 )
    ExFreePoolWithTag(v24, 0);
  return v8;
}

Referenced by: