FsRtlGetCompatibilityModeValue

NTSTATUS __stdcall FsRtlGetCompatibilityModeValue(_UNICODE_STRING *ValueName, UINT64 *Value){
  INT64 v2; 
  NTSTATUS result; 
  unsigned int v6; 
  unsigned int *v7; 
  char *i; 
  int v9; 
  VOID **PoolWithTag; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v14; 
  VOID *KeyHandle; 
  int v16[2]; 
  const wchar_t *v17; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[96]; 

  LODWORD(v14) = 0;
  v16[1] = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  v17 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem";
  v16[0] = 8126586;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v16;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  result = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v2, Length, (INT64)ResultLength, v14, 0i64);
  if( result >= 0 )
  {
    v6 = 92;
    v7 = (unsigned int *)KeyValueInformation;
    for( i = KeyValueInformation; ; i = (char *)PoolWithTag )
    {
      LODWORD(Lengtha) = v6;
      v9 = ZwQueryValueKey(KeyHandle, ValueName, KeyValueFullInformation, i, Lengtha, &v14);
      if( v9 != -2147483643 )
        break;
      if( v7 != (unsigned int *)KeyValueInformation )
        ExFreePoolWithTag(v7, 0);
      v6 += 256;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 544497990i64);
      v7 = (unsigned int *)PoolWithTag;
      if( !PoolWithTag )
        return -1073741801;
    }
    ZwClose((_HANDLE)KeyHandle);
    if( v9 >= 0 )
    {
      if( v7[3] )
        *(_DWORD *)Value = *(unsigned int *)((char *)v7 + v7[2]);
      else
        v9 = -1073741772;
    }
    if( v7 != (unsigned int *)KeyValueInformation )
      ExFreePoolWithTag(v7, 0);
    return v9;
  }
  return result;
}

Referenced by: