QueryRegistryHideMachine

BOOL __fastcall QueryRegistryHideMachine(INT64 a1, INT64 a2, WCHAR a3){
  int v3; 
  _DWORD *PoolWithTag; 
  WCHAR v5; 
  _DWORD *v6; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG ResultLength; 
  void *KeyHandle; 
  ResultLength = 0;
  v3 = 0;
  KeyHandle = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(
    &DestinationString,
    L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Restrictions",
    a3);
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  LODWORD(PoolWithTag) = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( (int)PoolWithTag >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"HideMachine", v5);
    LODWORD(PoolWithTag) = ZwQueryValueKey(
                             KeyHandle,
                             &DestinationString,
                             KeyValuePartialInformation,
                             0i64,
                             0,
                             &ResultLength);
    if( (_DWORD)PoolWithTag == -1073741789 )
    {
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, ResultLength, 0x74696E49ui64);
      v6 = PoolWithTag;
      if( PoolWithTag )
      {
        if( ZwQueryValueKey(
               KeyHandle,
               &DestinationString,
               KeyValuePartialInformation,
               PoolWithTag,
               ResultLength,
               &ResultLength) >= 0
          && v6[1] == 4
          && v6[2] == 4 )
        {
          v3 = v6[3];
        }
        ExFreePoolWithTag(v6, 0);
      }
    }
  }
  if( KeyHandle )
    LODWORD(PoolWithTag) = ZwClose(KeyHandle);
  LOBYTE(PoolWithTag) = v3 != 0;
  return(int)PoolWithTag;
}

Referenced by: