RtlpQueryRegistryDirect

NTSTATUS __stdcall RtlpQueryRegistryDirect(UINT64 ValueType, PVOID ValueData, UINT64 ValueLength, PVOID Destination){
  unsigned __int16 v4; 
  int v7; 
  UINT8 *v8; 
  unsigned __int64 v10; 
  UINT8 *StringRoutine; 
  UINT64 v12; 
  v4 = ValueLength;
  v7 = ValueType;
  if( (unsigned int)(ValueType - 1) > 1 && (_DWORD)ValueType != 7 )
  {
    if( (unsigned int)ValueLength <= 4 )
    {
      if( Destination == ValueData || !(_DWORD)ValueLength )
        return 0;
      goto LABEL_6;
    }
    v10 = *(unsigned int *)Destination;
    if( (v10 & 0x80000000) == 0i64 )
    {
      ValueLength = (unsigned int)ValueLength;
      if( v10 >= (unsigned __int64)(unsigned int)ValueLength + 8 )
      {
        *(_DWORD *)Destination = ValueLength;
        v8 = (UINT8 *)Destination + 8;
        *((_DWORD *)Destination + 1) = v7;
        goto LABEL_7;
      }
    }
    else if( -(int)v10 >= (unsigned int)ValueLength )
    {
LABEL_6:
      ValueLength = (unsigned int)ValueLength;
      v8 = (UINT8 *)Destination;
LABEL_7:
      memmove(v8, (UINT8 *)ValueData, ValueLength);
      return 0;
    }
    return -1073741789;
  }
  if( (unsigned int)ValueLength > 0xFFFE )
    v4 = -2;
  StringRoutine = (UINT8 *)*((_QWORD *)Destination + 1);
  if( StringRoutine )
  {
    if( v4 > *((_WORD *)Destination + 1) )
      return -1073741789;
    v12 = v4;
LABEL_17:
    memmove(StringRoutine, (UINT8 *)ValueData, v12);
    *(_WORD *)Destination = v4 - 2;
    return 0;
  }
  v12 = v4;
  StringRoutine = (UINT8 *)ExpAllocateStringRoutine(v4);
  *((_QWORD *)Destination + 1) = StringRoutine;
  if( StringRoutine )
  {
    *((_WORD *)Destination + 1) = v4;
    goto LABEL_17;
  }
  return -1073741801;
}

Referenced by: