PiDevCfgResolveVariableKeyCopy
__int64 __fastcall PiDevCfgResolveVariableKeyCopy(_QWORD *a1, void *a2, __int64 a3){
int v5;
int v6;
NTSTATUS RegistryValue;
unsigned int *v8;
HANDLE v9;
void *P[3];
HANDLE Handle;
Handle = 0i64;
P[0] = 0i64;
v5 = 0;
v6 = PiDevCfgResolveVariableKeyHandle(a1, a2, &Handle);
if( v6 < 0 )
goto LABEL_12;
RegistryValue = IopGetRegistryValue(a2, (PWCHAR)L"Delete", 0i64, (KEY_VALUE_FULL_INFORMATION **)P);
v8 = (unsigned int *)P[0];
v6 = RegistryValue;
if( RegistryValue >= 0 )
{
if( !PnpValidateRegistryValue((_KEY_VALUE_FULL_INFORMATION *)P[0]) )
{
v6 = -1073741823;
goto LABEL_10;
}
if( *(unsigned int *)((char *)v8 + v8[2]) )
v5 = 0x100000;
}
else
{
if( RegistryValue != -1073741772 )
goto LABEL_10;
v6 = 0;
}
v9 = Handle;
*(_DWORD *)(a3 + 36) = 0;
Handle = 0i64;
*(_DWORD *)(a3 + 32) = v5 | 0x8000;
*(_QWORD *)(a3 + 40) = v9;
LABEL_10:
if( v8 )
ExFreePoolWithTag(v8, 0);
LABEL_12:
if( Handle )
ZwClose(Handle);
return(unsigned int)v6;
}Referenced by:
No references.