PipGetRegistrySecurityWithFallback

PVOID __fastcall PipGetRegistrySecurityWithFallback(__int64 a1, const wchar_t *a2, __int64 a3, __int64 a4, __int64 a5){
  bool v8; 
  void *PoolWithTag; 
  int DeviceRegProp; 
  __int64 v11; 
  int InstallerClassRegProp; 
  int v14; 
  PVOID OutputSecurityDescriptor; 
  SIZE_T NumberOfBytes; 
  v14 = 0;
  OutputSecurityDescriptor = 0i64;
  LODWORD(NumberOfBytes) = 128;
  v8 = 0;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x80ui64, 0x6E657050ui64);
  if( !PoolWithTag )
    return 0i64;
  DeviceRegProp = CmGetDeviceRegProp(
                    PiPnpRtlCtx,
                    a2,
                    a3,
                    24,
                    (__int64)&v14,
                    (__int64)PoolWithTag,
                    (__int64)&NumberOfBytes,
                    0);
  if( DeviceRegProp == -1073741789 )
  {
    ExFreePoolWithTag(PoolWithTag, 0);
    PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x6E657050ui64);
    if( !PoolWithTag )
      return 0i64;
    DeviceRegProp = CmGetDeviceRegProp(
                      PiPnpRtlCtx,
                      a2,
                      a3,
                      24,
                      (__int64)&v14,
                      (__int64)PoolWithTag,
                      (__int64)&NumberOfBytes,
                      0);
  }
  if( DeviceRegProp >= 0
    && v14 == 3
    && RtlValidRelativeSecurityDescriptor(PoolWithTag, (unsigned int)NumberOfBytes, 0i64)
    && SeCaptureSecurityDescriptor(PoolWithTag, 0, PagedPool, 1u, &OutputSecurityDescriptor) >= 0 )
  {
    v8 = 1;
  }
  else
  {
    v11 = a5;
    if( a5 )
    {
      InstallerClassRegProp = CmGetInstallerClassRegProp(
                                PiPnpRtlCtx,
                                a4,
                                a5,
                                24,
                                (__int64)&v14,
                                (__int64)PoolWithTag,
                                (__int64)&NumberOfBytes);
      if( InstallerClassRegProp == -1073741789 )
      {
        ExFreePoolWithTag(PoolWithTag, 0);
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x6E657050ui64);
        if( !PoolWithTag )
          return 0i64;
        InstallerClassRegProp = CmGetInstallerClassRegProp(
                                  PiPnpRtlCtx,
                                  a4,
                                  v11,
                                  24,
                                  (__int64)&v14,
                                  (__int64)PoolWithTag,
                                  (__int64)&NumberOfBytes);
      }
      if( InstallerClassRegProp >= 0 && v14 == 3 )
      {
        if( RtlValidRelativeSecurityDescriptor(PoolWithTag, (unsigned int)NumberOfBytes, 0i64) )
          v8 = SeCaptureSecurityDescriptor(PoolWithTag, 0, PagedPool, 1u, &OutputSecurityDescriptor) >= 0;
      }
    }
  }
  ExFreePoolWithTag(PoolWithTag, 0);
  if( !v8 )
    return 0i64;
  return OutputSecurityDescriptor;
}

Referenced by: