FsRtlGetTunnelParameterValue

INT64 __fastcall FsRtlGetTunnelParameterValue(INT64 a1){
  _DWORD *v1; 
  _DWORD *v2; 
  INT64 result; 
  ULONG Length; 
  unsigned int *v6; 
  char *i; 
  NTSTATUS v8; 
  char *PoolWithTag; 
  ULONG ResultLength; 
  void *KeyHandle; 
  int v12[2]; 
  const WCHAR *v13; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[96]; 
  KeyHandle = 0i64;
  ResultLength = 0;
  v12[1] = 0;
  v2 = v1;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  v13 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem";
  v12[0] = 8126586;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v12;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  LODWORD(result) = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( (int)result >= 0 )
  {
    Length = 92;
    v6 = (unsigned int *)KeyValueInformation;
    for( i = KeyValueInformation; ; i = PoolWithTag )
    {
      v8 = ZwQueryValueKey(KeyHandle, (PUNICODE_STRING)a1, KeyValueFullInformation, i, Length, &ResultLength);
      if( v8 != -2147483643 )
        break;
      if( v6 != (unsigned int *)KeyValueInformation )
        ExFreePoolWithTag(v6, 0);
      Length += 256;
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, Length, 0x4B6E7554ui64);
      v6 = (unsigned int *)PoolWithTag;
      if( !PoolWithTag )
        return 3221225495i64;
    }
    ZwClose(KeyHandle);
    if( v8 >= 0 )
    {
      if( v6[3] )
        *v2 = *(unsigned int *)((char *)v6 + v6[2]);
      else
        v8 = -1073741772;
    }
    if( v6 != (unsigned int *)KeyValueInformation )
      ExFreePoolWithTag(v6, 0);
    return(unsigned int)v8;
  }
  return result;
}

Referenced by: