CmpGetRegistryValue

NTSTATUS __stdcall CmpGetRegistryValue(PVOID KeyHandle, PWCHAR ValueName, _KEY_VALUE_PARTIAL_INFORMATION **Information){
  NTSTATUS result; 
  VOID **PoolWithTag; 
  _KEY_VALUE_PARTIAL_INFORMATION *v7; 
  int v8; 
  UINT64 Length; 
  UINT64 Lengtha; 
  _UNICODE_STRING ValueNamea; 
  UINT64 NumberOfBytes; 

  LODWORD(NumberOfBytes) = 0;
  ValueNamea = 0i64;
  RtlInitUnicodeString(&ValueNamea, ValueName);
  LODWORD(Length) = 0;
  result = ZwQueryValueKey(KeyHandle, &ValueNamea, KeyValuePartialInformation, 0i64, Length, &NumberOfBytes);
  if( result >= 0 || result == -2147483643 || result == -1073741789 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)NumberOfBytes, 1229996865i64);
    v7 = (_KEY_VALUE_PARTIAL_INFORMATION *)PoolWithTag;
    if( PoolWithTag )
    {
      LODWORD(Lengtha) = NumberOfBytes;
      v8 = ZwQueryValueKey(KeyHandle, &ValueNamea, KeyValuePartialInformation, PoolWithTag, Lengtha, &NumberOfBytes);
      if( v8 >= 0 )
      {
        *Information = v7;
        return 0;
      }
      else
      {
        ExFreePoolWithTag(v7, 0);
        return v8;
      }
    }
    else
    {
      return -1073741670;
    }
  }
  return result;
}

Referenced by: