PiCreateDriverRedirectedStateKey

NTSTATUS __stdcall PiCreateDriverRedirectedStateKey(ULONG CreateOptions){
  _QWORD *v1; 
  _UNICODE_STRING *v2; 
  CHAR *v3; 
  void *v4; 
  _QWORD *v5; 
  int StateRootPath; 
  unsigned int v8; 
  unsigned int v9; 
  INT64 v10; 
  NTSTATUS v11; 
  NTSTATUS ServiceStateSecurityObject; 
  NTSTATUS v13; 
  VOID *v14; 
  INT64 v15; 
  INT64 v16; 
  INT64 v17; 
  CHAR *v18; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING UnicodeString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Handle; 
  void *v23; 

  v2 = *(_UNICODE_STRING **)&CreateOptions;
  v3 = 0i64;
  v4 = 0i64;
  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v18 = 0i64;
  v5 = v1;
  v23 = 0i64;
  UnicodeString = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  RtlInitUnicodeString(&UnicodeString, 0i64);
  if( !v2 || !v2->Buffer || v2->Length < 2u || !v5 )
  {
    StateRootPath = -1073741811;
    goto LABEL_6;
  }
  StateRootPath = PiGetStateRootPath(L"DriverStatePath");
  if( StateRootPath < 0 )
    goto LABEL_6;
  v8 = v2->Length + 2;
  v9 = v8 + DestinationString.Length;
  if( v9 < v8 )
  {
    StateRootPath = -1073741675;
  }
  else
  {
    if( v9 > 0xFFFE )
    {
      StateRootPath = -2147483643;
      goto LABEL_6;
    }
    StateRootPath = IopAllocateUnicodeString(&UnicodeString, v9);
    if( StateRootPath >= 0 )
    {
      StateRootPath = RtlUnicodeStringPrintfEx(&UnicodeString, 0i64, 0x800ui64, (WCHAR *)L"%wZ\\%wZ");
      if( StateRootPath >= 0 )
      {
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.ObjectName = &UnicodeString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v11 = ZwOpenKey(&Handle, 4ui64, &ObjectAttributes, v10, (INT64)&DestinationString, (INT64)v2, v16, v17);
        StateRootPath = v11;
        if( v11 != -1073741772 )
          goto LABEL_25;
        ServiceStateSecurityObject = PiAuGetServiceStateSecurityObject(&v18);
        v3 = v18;
        StateRootPath = ServiceStateSecurityObject;
        if( ServiceStateSecurityObject < 0 )
          goto LABEL_6;
        v13 = PiCreateRegistryPath(&DestinationString);
        v4 = v23;
        StateRootPath = v13;
        if( v13 == -1073741772 )
          goto LABEL_24;
        if( v13 < 0 )
          goto LABEL_6;
        LODWORD(v15) = 0;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = v23;
        ObjectAttributes.Attributes = 576;
        ObjectAttributes.ObjectName = v2;
        ObjectAttributes.SecurityDescriptor = v3;
        v11 = ZwCreateKey(&Handle, 4ui64, &ObjectAttributes, 0i64, 0i64, v15, 0i64);
        StateRootPath = v11;
        if( v11 == -1073741772 )
        {
LABEL_24:
          StateRootPath = -1073741595;
        }
        else
        {
LABEL_25:
          if( v11 >= 0 )
          {
            v14 = Handle;
            Handle = 0i64;
            *v5 = v14;
          }
        }
      }
    }
  }
LABEL_6:
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&UnicodeString);
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( v4 )
    ZwClose((_HANDLE)v4);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return StateRootPath;
}

Referenced by: