PopDirectedDripsQueryRegistryValues

INT64 __fastcall PopDirectedDripsQueryRegistryValues(INT64 a1, _DWORD *a2, WCHAR a3){
  PVOID *v3; 
  bool v4; 
  INT64 result; 
  WCHAR v7; 
  PULONG ResultLength; 
  UINT64 Disposition; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v14; 
  Disposition = 0i64;
  v3 = (PVOID *)(a1 + 544);
  KeyHandle = (void *)-1i64;
  *a2 = 3;
  v4 = *(_QWORD *)(a1 + 544) == -1i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v14 = 0;
  DestinationString = 0i64;
  KeyValueInformation = 0i64;
  if( !v4 )
    goto LABEL_8;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSet;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(result) = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( (int)result >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Control\\Power", v7);
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 576;
    LODWORD(ResultLength) = 0;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    LODWORD(result) = ZwCreateKey(v3, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, (UINT64)ResultLength, &Disposition);
    if( (int)result >= 0 )
    {
LABEL_8:
      RtlInitUnicodeString(&DestinationString, L"DirectedDripsAction", a3);
      LODWORD(result) = ZwQueryValueKey(
                          *v3,
                          &DestinationString,
                          KeyValuePartialInformation,
                          &KeyValueInformation,
                          0x14u,
                          (PULONG)&Disposition + 1);
      if( (int)result >= 0 && DWORD2(KeyValueInformation) == 4 )
      {
        result = HIDWORD(KeyValueInformation);
        *a2 = HIDWORD(KeyValueInformation);
      }
    }
  }
  if( KeyHandle != (void *)-1i64 )
    LODWORD(result) = ZwClose(KeyHandle);
  return result;
}

Referenced by: