CmpReadBuildLab

INT64 __fastcall CmpReadBuildLab(UINT8 **a1, _DWORD *a2, WCHAR a3){
  UINT8 *v5; 
  NTSTATUS v6; 
  WCHAR v7; 
  _CHILD_LIST *v8; 
  UINT8 *v9; 
  _CHILD_LIST *v10; 
  UINT8 *v11; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG ResultLength; 
  ULONG v17; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  v17 = 0;
  ResultLength = 0;
  DestinationString = 0i64;
  v5 = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION", a3);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v6 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( v6 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"BuildLab", v7);
    v6 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, 0i64, 0, &ResultLength);
    if( v6 == -1073741789 )
    {
      CmpAllocateTransientPoolWithTag((_HHIVE *)1, ResultLength, 0x30384D43ui64, v8);
      v5 = v9;
      if( !v9 )
      {
LABEL_4:
        v6 = -1073741670;
        goto LABEL_8;
      }
      v6 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, v9, ResultLength, &v17);
      if( v6 >= 0 )
      {
        CmpAllocateTransientPoolWithTag((_HHIVE *)1, *((unsigned int *)v5 + 2), 0x30384D43ui64, v10);
        *a1 = v11;
        if( !v11 )
          goto LABEL_4;
        memmove(v11, v5 + 12, *((unsigned int *)v5 + 2));
        *a2 = *((_DWORD *)v5 + 2);
      }
    }
  }
LABEL_8:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( v5 )
    CmSiFreeMemory((PPRIVILEGE_SET)v5);
  return(unsigned int)v6;
}

Referenced by: