ArbpGetRegistryValue

INT64 __stdcall ArbpGetRegistryValue(PVOID KeyHandle, WCHAR *ValueName, KEY_VALUE_FULL_INFORMATION **Information){
  NTSTATUS v5; 
  KEY_VALUE_FULL_INFORMATION *PoolWithTag; 
  KEY_VALUE_FULL_INFORMATION *v7; 
  NTSTATUS v8; 
  struct _UNICODE_STRING ValueNamea; 
  ULONG ResultLength; 
  ResultLength = 0;
  ValueNamea = 0i64;
  RtlInitUnicodeString(&ValueNamea, ValueName, (WCHAR)Information);
  v5 = ZwQueryValueKey(KeyHandle, &ValueNamea, KeyValueFullInformationAlign64, 0i64, 0, &ResultLength);
  if( v5 != -1073741789 && v5 != -2147483643 )
    return 3221225473i64;
  PoolWithTag = (KEY_VALUE_FULL_INFORMATION *)ExAllocatePoolWithTag(PagedPool, ResultLength, 0x4D627241ui64);
  v7 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  v8 = ZwQueryValueKey(KeyHandle, &ValueNamea, KeyValueFullInformationAlign64, PoolWithTag, ResultLength, &ResultLength);
  if( v8 < 0 )
  {
    ExFreePoolWithTag(v7, 0);
    return(unsigned int)v8;
  }
  else
  {
    *Information = v7;
    return 0i64;
  }
}

Referenced by: