PiDevCfgMakeServiceBootStart

VOID __fastcall PiDevCfgMakeServiceBootStart(const WCHAR *ServiceName, INT64 a2, INT64 a3, INT64 a4){
  _WORD *v4; 
  void *v5; 
  UINT64 v6; 
  WCHAR *v7; 
  unsigned __int16 v8; 
  __int64 v9; 
  char *v10; 
  WCHAR v11; 
  UINT64 DataSize; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING Data; 
  UNICODE_STRING String2; 
  int v16; 
  PVOID P; 
  HANDLE KeyHandle; 
  v16 = 4;
  KeyHandle = 0i64;
  P = 0i64;
  *(_DWORD *)(&String2.MaximumLength + 1) = 0;
  *(_QWORD *)&Data.Length = 0i64;
  DestinationString = 0i64;
  Data.Buffer = 0i64;
  RtlInitUnicodeString(&DestinationString, ServiceName, a3);
  if( PipOpenServiceEnumKeys(&DestinationString, 0x2001Fui64, &KeyHandle, 0i64, 0) < 0 )
    goto LABEL_17;
  if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"Start", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) < 0 )
    goto LABEL_14;
  v4 = P;
  if( !PnpValidateRegistryDword((KEY_VALUE_FULL_INFORMATION *)P) )
    goto LABEL_15;
  v16 = *(_DWORD *)((char *)v4 + *((unsigned int *)v4 + 2));
  ExFreePoolWithTag(v5, 0);
  P = 0i64;
  if( (v16 & 0xFFFFFFFB) == 0 )
    goto LABEL_17;
  if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"ImagePath", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) < 0 )
  {
LABEL_14:
    v4 = P;
    goto LABEL_15;
  }
  v4 = P;
  if( (unsigned int)(*((_DWORD *)P + 1) - 1) <= 1
    && PnpValidateStringData((PWCHAR)((char *)P + *((unsigned int *)P + 2)), *((unsigned int *)P + 3)) )
  {
    LODWORD(P) = 0;
    PnpRegSzToString(v7, v6, (UINT64 *)&P);
    v8 = v4[6];
    v9 = *((unsigned int *)v4 + 2);
    String2.Length = (unsigned __int16)P;
    v10 = (char *)v4 + v9;
    String2.Buffer = (wchar_t *)v10;
    String2.MaximumLength = v8;
    if( (unsigned __int8)RtlPrefixUnicodeString((PVOID)&PiDevCfgSystemRoot, (INT64 *)&String2) )
    {
      RtlInitUnicodeString(&Data, (PCWSTR)v10 + 12, v11);
      LODWORD(DataSize) = Data.Length + 2;
      *(_DWORD *)&DestinationString.Length = 1310738;
      DestinationString.Buffer = (wchar_t *)L"ImagePath";
      if( ZwSetValueKey(KeyHandle, &DestinationString, 0i64, *((unsigned int *)v4 + 1), Data.Buffer, DataSize) < 0 )
        goto LABEL_15;
      goto LABEL_13;
    }
    if( (unsigned __int8)RtlPrefixUnicodeString((PVOID)&PiDevCfgSystem32, (INT64 *)&String2) )
    {
LABEL_13:
      LODWORD(DataSize) = 4;
      *(_DWORD *)&DestinationString.Length = 786442;
      DestinationString.Buffer = (wchar_t *)L"Start";
      v16 = 0;
      ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &v16, DataSize);
    }
  }
LABEL_15:
  if( v4 )
    ExFreePoolWithTag(v4, 0);
LABEL_17:
  if( KeyHandle )
    ZwClose(KeyHandle);
}

Referenced by: