PiDqDeleteUserObject
NTSTATUS __stdcall PiDqDeleteUserObject(VOID *userKey, WCHAR *ObjectName, PNP_OBJECT_TYPE ObjectType){
int RelativeObjectRegPath;
__int64 v6;
VOID *v7;
unsigned int v8;
int v9;
unsigned int i;
WORD *v11;
__int64 v12;
VOID *v13;
WCHAR *SubKey;
SubKey = 0i64;
RelativeObjectRegPath = PiDqGetRelativeObjectRegPath(ObjectName, ObjectType, &SubKey);
if( RelativeObjectRegPath < 0 )
goto LABEL_17;
if( *(&stru_140CF2E80 + 607) && (v6 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64)) != 0 )
v7 = *(VOID **)(v6 + 8);
else
v7 = 0i64;
RelativeObjectRegPath = RegRtlDeleteTreeInternal(userKey, SubKey, v7, 0);
v8 = 2;
v9 = ObjectType - 1;
if( !v9 )
goto LABEL_8;
if( v9 != 2 )
{
v8 = 0;
LABEL_8:
if( !v8 )
goto LABEL_17;
goto LABEL_11;
}
v8 = 1;
LABEL_11:
for( i = 0; i < v8; ++i )
{
v11 = wcsrchr(SubKey, 92);
if( v11 )
{
*v11 = 0;
if( *(&stru_140CF2E80 + 607) && (v12 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64)) != 0 )
v13 = *(VOID **)(v12 + 8);
else
v13 = 0i64;
if( (int)RegRtlDeleteKeyTransacted(userKey, SubKey, v13) < 0 )
break;
}
}
LABEL_17:
if( SubKey )
ExFreePoolWithTag(SubKey, 0x58706E50u);
return RelativeObjectRegPath;
}Referenced by:
PiDqDeleteUserObjectFromLoadedHives