PiOpenDriverRedirectedStateKey

INT64 __fastcall PiOpenDriverRedirectedStateKey(UINT16 *a1, INT64 a2, _QWORD *a3){
  WCHAR v5; 
  int StateRootPath; 
  unsigned int v8; 
  unsigned int v9; 
  int v10; 
  HANDLE v11; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING UnicodeString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  HANDLE Handle; 
  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  UnicodeString = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)a3);
  RtlInitUnicodeString(&UnicodeString, 0i64, v5);
  if( a1 && *((_QWORD *)a1 + 1) && *a1 >= 2u && a3 )
  {
    StateRootPath = PiGetStateRootPath(L"DriverStatePath");
    if( StateRootPath >= 0 )
    {
      v8 = *a1 + 2;
      v9 = v8 + DestinationString.Length;
      if( v9 < v8 )
      {
        StateRootPath = -1073741675;
      }
      else if( v9 <= 0xFFFE )
      {
        StateRootPath = IopAllocateUnicodeString(&UnicodeString, v9);
        if( StateRootPath >= 0 )
        {
          RtlUnicodeStringPrintfEx(&UnicodeString, 0i64, 0x800ui64, L"%wZ\\%wZ");
          StateRootPath = v10;
          if( v10 >= 0 )
          {
            ObjectAttributes.RootDirectory = 0i64;
            ObjectAttributes.ObjectName = &UnicodeString;
            ObjectAttributes.Length = 48;
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            StateRootPath = ZwOpenKey(&Handle, 0x30006u, &ObjectAttributes);
            if( StateRootPath == -1073741772 )
              StateRootPath = -1073741275;
            if( StateRootPath >= 0 )
            {
              v11 = Handle;
              Handle = 0i64;
              *a3 = v11;
            }
          }
        }
      }
      else
      {
        StateRootPath = -2147483643;
      }
    }
  }
  else
  {
    StateRootPath = -1073741811;
  }
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&UnicodeString);
  if( Handle )
    ZwClose(Handle);
  return(unsigned int)StateRootPath;
}

Referenced by: