PiDqDeleteUserObjectFromLoadedHives
VOID __stdcall PiDqDeleteUserObjectFromLoadedHives(WCHAR *ObjectName, PNP_OBJECT_TYPE ObjectType){
__int64 v4;
unsigned int i;
__int64 v6;
INT64 a5;
INT64 a6;
VOID *hKey;
INT64 a8;
VOID *Handle;
WCHAR KeyName[256];
hKey = 0i64;
Handle = 0i64;
if( *(&stru_140CF2E80 + 607) )
v4 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64);
else
v4 = 0i64;
if( SysCtxRegOpenKey(v4, 0i64, L"\\REGISTRY\\USER", 0, 8u, &hKey) >= 0 )
{
for( i = 0; ; ++i )
{
LODWORD(a8) = 256;
if( RegRtlEnumKey(hKey, i, KeyName, (UINT64 *)&a8, a5, a6, (INT64)hKey, a8) < 0 )
break;
if( *(&stru_140CF2E80 + 607) )
v6 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64);
else
v6 = 0i64;
if( SysCtxRegOpenKey(v6, hKey, KeyName, 0, 1u, &Handle) >= 0 )
{
PiDqDeleteUserObject(Handle, ObjectName, ObjectType);
ZwClose((_HANDLE)Handle);
}
}
}
if( hKey )
ZwClose((_HANDLE)hKey);
}Referenced by:
No references.