PAGED NTSTATUS QueryValueBlob()

in rtl/inc/kregkey.h [143:194]


    PAGED NTSTATUS QueryValueBlob(
        _In_ PCUNICODE_STRING Name,
        _In_ Lambda Callback,
        _In_ ULONG ExpectedDataType = REG_BINARY)
    {
        NTSTATUS NtStatus;

        union
        {
            KEY_VALUE_PARTIAL_INFORMATION StackInformation;
            UCHAR Buffer[256];
        };

        KEY_VALUE_PARTIAL_INFORMATION *Information = &StackInformation;
        wistd::unique_ptr<UCHAR[]> HeapBuffer;

        ULONG BytesNeeded;
        NtStatus = ZwQueryValueKey(
                *this,
                const_cast<PUNICODE_STRING>(Name),
                KeyValuePartialInformation,
                Buffer,
                sizeof(Buffer),
                &BytesNeeded);
        if (NtStatus == STATUS_BUFFER_OVERFLOW)
        {
            HeapBuffer.reset(new(std::nothrow, 'niBR') UCHAR[BytesNeeded]);
            if (!HeapBuffer)
                return STATUS_INSUFFICIENT_RESOURCES;

            NtStatus = ZwQueryValueKey(
                    *this,
                    const_cast<PUNICODE_STRING>(Name),
                    KeyValuePartialInformation,
                    HeapBuffer.get(),
                    BytesNeeded,
                    &BytesNeeded);
            if (!NT_SUCCESS(NtStatus))
                return NtStatus;

            Information = reinterpret_cast<KEY_VALUE_PARTIAL_INFORMATION*>(HeapBuffer.get());
        }
        else if (!NT_SUCCESS(NtStatus))
        {
            return NtStatus;
        }

        if (Information->Type != ExpectedDataType)
            return STATUS_OBJECT_TYPE_MISMATCH;

        return Callback(Information->Data, Information->DataLength);
    }