PiCMOpenDeviceKey

NTSTATUS __stdcall PiCMOpenDeviceKey(
        VOID *IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        VOID *IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  unsigned int v5; 
  UINT64 *v6; 
  char PreviousMode; 
  NTSTATUS v9; 
  WCHAR *v10; 
  NTSTATUS v11; 
  unsigned int v12; 
  UINT64 v13; 
  NTSTATUS v14; 
  VOID **DesiredAccess; 
  VOID **DeviceKey; 
  INT64 v18; 
  PVOID SourceHandle; 
  VOID *Handle; 
  _CMAPI_DEVICE_KEY_TYPE CmapiKeyType[4]; 
  UINT64 v22[2]; 
  UINT64 HardwareProfileId[2]; 
  UINT64 *PnpRtlKeyType; 

  Handle = 0i64;
  SourceHandle = 0i64;
  v5 = IoctlOutputBufferSize;
  v6 = PnpRtlKeyType;
  LODWORD(PnpRtlKeyType) = 0;
  *(_OWORD *)CmapiKeyType = 0i64;
  *(_DWORD *)v6 = 0;
  *(_OWORD *)v22 = 0i64;
  *(_OWORD *)HardwareProfileId = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v9 = PiCMCaptureRegistryInputData(IoctlInputBuffer, IoctlInputBufferSize, (int)BytesUsed, (__int64)CmapiKeyType);
  if( v9 < 0 )
    goto LABEL_14;
  v10 = (WCHAR *)v22[0];
  if( v22[0] && CmapiKeyType[2] == 1 && IoctlOutputBuffer && v5 >= 0x10 )
  {
    v11 = PiCMConvertDeviceKeyType(CmapiKeyType[1], (_CM_KEY_TYPE *)&PnpRtlKeyType);
    if( v11 >= 0 )
    {
      v12 = HIDWORD(v22[1]);
      LODWORD(DesiredAccess) = HIDWORD(v22[1]);
      v11 = CmOpenDeviceRegKey(
              *(&stru_140CF2E80 + 607),
              v10,
              (_CM_KEY_TYPE)PnpRtlKeyType,
              HIDWORD(HardwareProfileId[0]),
              (UINT64)DesiredAccess,
              0,
              &SourceHandle,
              0i64);
      if( v11 != -1073741772 )
        goto LABEL_8;
      if( LODWORD(HardwareProfileId[0]) == 1 )
      {
        if( PiAuDoesClientHaveAccess(2ui64) )
        {
          LODWORD(DesiredAccess) = v12;
          v11 = CmOpenDeviceRegKey(
                  *(&stru_140CF2E80 + 607),
                  v10,
                  (_CM_KEY_TYPE)PnpRtlKeyType,
                  HIDWORD(HardwareProfileId[0]),
                  (UINT64)DesiredAccess,
                  1u,
                  &SourceHandle,
                  0i64);
LABEL_8:
          if( v11 >= 0 )
          {
            DesiredAccess = &Handle;
            PiCMDuplicateRegistryHandle(SourceHandle, v13, (UINT64 *)v12, PreviousMode);
            v11 = v14;
          }
          goto LABEL_10;
        }
        v11 = -1073741790;
      }
    }
  }
  else
  {
    v11 = -1073741811;
  }
LABEL_10:
  LODWORD(DesiredAccess) = v5;
  v9 = PiCMReturnHandleResultData(
         (unsigned int)v11,
         Handle,
         LODWORD(HardwareProfileId[1]),
         IoctlOutputBuffer,
         (UINT64)DesiredAccess,
         v6,
         (INT64)DeviceKey,
         v18);
  if( SourceHandle )
    ZwClose((_HANDLE)SourceHandle);
  if( v9 < 0 || v11 < 0 )
  {
    if( Handle )
      ObCloseHandle(Handle, PreviousMode);
  }
LABEL_14:
  PiCMReleaseRegistryInputData((__int64)CmapiKeyType);
  return v9;
}

Referenced by: