IopCreateSecureDeviceClassSettings

INT64 __fastcall IopCreateSecureDeviceClassSettings(GUID *Guid, INT64 a2, BYTE *a3){
  void *v6; 
  int SecureDeviceClassState; 
  INT64 v8; 
  INT64 v9; 
  int PersistedStateLocation; 
  WCHAR v12; 
  NTSTATUS v13; 
  NTSTATUS v14; 
  PVOID *v15; 
  WCHAR v16; 
  WCHAR v17; 
  PVOID Data; 
  UINT64 DataSize; 
  UINT64 DataSizea; 
  UINT64 DataSizeb; 
  HANDLE Handle; 
  void *KeyHandle; 
  HANDLE v24; 
  UNICODE_STRING String1; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UNICODE_STRING String2; 
  struct _UNICODE_STRING DestinationString; 
  void *SourceString[3]; 
  UINT64 Disposition; 
  *(_QWORD *)&String2.Length = 7471216i64;
  LODWORD(Disposition) = 0;
  String2.Buffer = (wchar_t *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class";
  Handle = 0i64;
  SourceString[0] = 0i64;
  KeyHandle = 0i64;
  v24 = 0i64;
  String1 = 0i64;
  v6 = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)a3);
  SecureDeviceClassState = RtlStringFromGUIDEx(Guid, &DestinationString, 1u);
  if( SecureDeviceClassState >= 0 )
  {
    *(_QWORD *)&ObjectAttributes.Length = 48i64;
    ObjectAttributes.ObjectName = &String2;
    *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
    ObjectAttributes.RootDirectory = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    SecureDeviceClassState = ZwOpenKey(&KeyHandle, 0xF003Fu, &ObjectAttributes);
    if( SecureDeviceClassState < 0 )
      goto LABEL_44;
    ObjectAttributes.RootDirectory = KeyHandle;
    *(_QWORD *)&ObjectAttributes.Length = 48i64;
    ObjectAttributes.ObjectName = &DestinationString;
    *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    SecureDeviceClassState = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
    if( SecureDeviceClassState < 0
      || (RtlInitUnicodeString(&String1, L"Properties", v9),
          ObjectAttributes.RootDirectory = Handle,
          *(_QWORD *)&ObjectAttributes.Length = 48i64,
          ObjectAttributes.ObjectName = &String1,
          *(_QWORD *)&ObjectAttributes.Attributes = 576i64,
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
          SecureDeviceClassState = ZwOpenKey(&v24, 0x20019u, &ObjectAttributes),
          SecureDeviceClassState < 0) )
    {
LABEL_44:
      if( SecureDeviceClassState != -1073741772 )
        goto LABEL_12;
    }
    else
    {
      SecureDeviceClassState = IopQuerySecureDeviceClassState(v24);
      if( SecureDeviceClassState < 0 )
        goto LABEL_12;
      if( (*a3 & 0xF) == 15 )
        goto LABEL_11;
    }
    PersistedStateLocation = IopGetPersistedStateLocation(v8, String2.Buffer, v9, (CHAR **)SourceString);
    v6 = SourceString[0];
    SecureDeviceClassState = PersistedStateLocation;
    if( PersistedStateLocation >= 0 )
    {
      SecureDeviceClassState = RtlInitUnicodeStringEx(&String1, (WCHAR *)SourceString[0]);
      if( SecureDeviceClassState >= 0 )
      {
        if( RtlEqualUnicodeString(&String1, &String2, 1u) )
        {
          if( Handle )
          {
LABEL_11:
            SecureDeviceClassState = 0;
            goto LABEL_12;
          }
        }
        else
        {
          if( KeyHandle )
          {
            ZwClose(KeyHandle);
            KeyHandle = 0i64;
          }
          if( Handle )
          {
            ZwClose(Handle);
            Handle = 0i64;
          }
          LODWORD(Data) = 0;
          SecureDeviceClassState = IopCreateRegistryKeyEx(
                                     &KeyHandle,
                                     0i64,
                                     &String1,
                                     0xF003Fui64,
                                     (UINT64)Data,
                                     &Disposition);
          if( SecureDeviceClassState < 0 )
            goto LABEL_12;
        }
        LODWORD(Data) = 0;
        SecureDeviceClassState = IopCreateRegistryKeyEx(
                                   &Handle,
                                   KeyHandle,
                                   &DestinationString,
                                   0xF003Fui64,
                                   (UINT64)Data,
                                   &Disposition);
        if( SecureDeviceClassState < 0 )
          goto LABEL_12;
        if( (_DWORD)Disposition == 2 )
        {
          if( v24 )
            ZwClose(v24);
          RtlInitUnicodeString(&String1, L"Properties", v12);
          ObjectAttributes.RootDirectory = Handle;
          *(_QWORD *)&ObjectAttributes.Length = 48i64;
          ObjectAttributes.ObjectName = &String1;
          *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
          v24 = 0i64;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          v13 = ZwOpenKey(&v24, 0x20019u, &ObjectAttributes);
          SecureDeviceClassState = v13;
          if( v13 >= 0 )
          {
            v14 = IopQuerySecureDeviceClassState(v24);
LABEL_41:
            SecureDeviceClassState = v14;
            goto LABEL_12;
          }
          if( v13 == -1073741772 )
            goto LABEL_11;
        }
        else
        {
          v15 = (PVOID *)(*(_QWORD *)(a2 + 48) + 24i64);
          if( *(_QWORD *)(a2 + 48) == -24i64 )
          {
            SecureDeviceClassState = -1073741670;
            goto LABEL_12;
          }
          RtlInitUnicodeString(&String1, L"Class", v12);
          LODWORD(DataSize) = *(unsigned __int16 *)v15 + 2;
          SecureDeviceClassState = ZwSetValueKey(Handle, &String1, 0i64, 1ui64, v15[1], DataSize);
          if( SecureDeviceClassState >= 0 )
          {
            RtlInitUnicodeString(&String1, L"NoDisplayClass", v16);
            LODWORD(DataSizea) = 4;
            SecureDeviceClassState = ZwSetValueKey(Handle, &String1, 0i64, 1ui64, L"1", DataSizea);
            if( SecureDeviceClassState >= 0 )
            {
              RtlInitUnicodeString(&String1, L"NoUseClass", v17);
              LODWORD(DataSizeb) = 4;
              v14 = ZwSetValueKey(Handle, &String1, 0i64, 1ui64, L"1", DataSizeb);
              goto LABEL_41;
            }
          }
        }
      }
    }
  }
LABEL_12:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( Handle )
    ZwClose(Handle);
  if( v24 )
    ZwClose(v24);
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  RtlFreeAnsiString(&DestinationString);
  return(unsigned int)SecureDeviceClassState;
}

Referenced by: