ExpReadComPlusPackage

INT64 __fastcall ExpReadComPlusPackage(){
  signed __int32 v0; 
  NTSTATUS v1; 
  ULONG ResultLength; 
  void *KeyHandle; 
  __int128 KeyValueInformation; 
  int v6; 
  ResultLength = 0;
  KeyHandle = 0i64;
  KeyValueInformation = 0i64;
  v6 = 0;
  v0 = 0;
  v1 = ZwOpenKey(&KeyHandle, 1u, &stru_140C02088);
  if( v1 >= 0 )
  {
    v1 = ZwQueryValueKey(
           KeyHandle,
           &stru_140C020B8,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x14u,
           &ResultLength);
    if( v1 >= 0 && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
      v0 = HIDWORD(KeyValueInformation);
    ZwClose(KeyHandle);
  }
  _InterlockedCompareExchange((volatile signed __int32 *)&KUSER_SHARED_DATA.ComPlusPackage, v0, -1);
  if( (int)(v1 + 0x80000000) < 0 || v1 == -1073741772 )
    return 0;
  return(unsigned int)v1;
}

Referenced by: