ApiSetpLoadSchemaExtension
INT64 __fastcall ApiSetpLoadSchemaExtension(VOID *a1, UINT8 **a2, UINT64 *a3){
int v5;
ULONG ResultLength;
UINT64 SchemaBufferSize;
VOID *SchemaBuffer;
struct _UNICODE_STRING ValueName;
_UNICODE_STRING SchemaPath;
char KeyValueInformation[8];
__int16 Source[138];
SchemaBuffer = 0i64;
SchemaBufferSize = 0i64;
*(_QWORD *)&SchemaPath.Length = 0i64;
ResultLength = 0;
SchemaPath.Buffer = 0i64;
ValueName.Buffer = L"FileName";
*(_QWORD *)&ValueName.Length = 1179664i64;
v5 = ZwQueryValueKey(a1, &ValueName, KeyValuePartialInformation, KeyValueInformation, 0x114u, &ResultLength);
if( v5 >= 0 )
{
v5 = ApiSetpConstructPathToExtension((PCWSTR)Source);
if( v5 >= 0 )
{
v5 = ApiSetLoadSchemaEx(&SchemaPath, &SchemaBuffer, &SchemaBufferSize);
if( v5 >= 0 )
v5 = ApiSetComposeSchema(a2, (unsigned int *)a3, SchemaBuffer, SchemaBufferSize);
}
}
if( SchemaPath.Buffer )
ExFreePoolWithTag(SchemaPath.Buffer, 0);
return(unsigned int)v5;
}Referenced by:
ApiSetpLoadSchemaExtensions