PiOpenDriverRedirectedStateKey

__int64 __fastcall PiOpenDriverRedirectedStateKey(unsigned __int16 *a1, __int64 a2, _QWORD *a3){
  NTSTATUS StateRootPath; 
  unsigned int v7; 
  unsigned int v8; 
  INT64 v9; 
  VOID *v10; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING UnicodeString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Handle; 

  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  UnicodeString = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  RtlInitUnicodeString(&UnicodeString, 0i64);
  if( a1 && *((_QWORD *)a1 + 1) && *a1 >= 2u && a3 )
  {
    StateRootPath = PiGetStateRootPath(L"DriverStatePath");
    if( StateRootPath >= 0 )
    {
      v7 = *a1 + 2;
      v8 = v7 + DestinationString.Length;
      if( v8 < v7 )
      {
        StateRootPath = -1073741675;
      }
      else if( v8 <= 0xFFFE )
      {
        StateRootPath = IopAllocateUnicodeString(&UnicodeString, v8);
        if( StateRootPath >= 0 )
        {
          StateRootPath = RtlUnicodeStringPrintfEx(&UnicodeString, 0i64, 0x800ui64, (WCHAR *)L"%wZ\\%wZ");
          if( StateRootPath >= 0 )
          {
            ObjectAttributes.RootDirectory = 0i64;
            ObjectAttributes.ObjectName = &UnicodeString;
            ObjectAttributes.Length = 48;
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            StateRootPath = ZwOpenKey(
                              &Handle,
                              0x30006ui64,
                              &ObjectAttributes,
                              v9,
                              (INT64)&DestinationString,
                              (INT64)a1,
                              *(INT64 *)&DestinationString.Length,
                              (INT64)DestinationString.Buffer);
            if( StateRootPath == -1073741772 )
              StateRootPath = -1073741275;
            if( StateRootPath >= 0 )
            {
              v10 = Handle;
              Handle = 0i64;
              *a3 = v10;
            }
          }
        }
      }
      else
      {
        StateRootPath = -2147483643;
      }
    }
  }
  else
  {
    StateRootPath = -1073741811;
  }
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&UnicodeString);
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return(unsigned int)StateRootPath;
}

Referenced by: