PiCreateDriverRedirectedStateKey

INT64 __stdcall PiCreateDriverRedirectedStateKey(UINT32 CreateOptions){
  _QWORD *v1; 
  _UNICODE_STRING *v2; 
  CHAR *v3; 
  void *v4; 
  _QWORD *v5; 
  WCHAR v6; 
  int StateRootPath; 
  unsigned int v9; 
  unsigned int v10; 
  int v11; 
  NTSTATUS v12; 
  int ServiceStateSecurityObject; 
  int v14; 
  HANDLE v15; 
  UINT64 CreateOptionsa; 
  CHAR *v17; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING UnicodeString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  HANDLE Handle; 
  void *v22; 
  v2 = *(_UNICODE_STRING **)&CreateOptions;
  v3 = 0i64;
  v4 = 0i64;
  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v17 = 0i64;
  v5 = v1;
  v22 = 0i64;
  UnicodeString = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)v1);
  RtlInitUnicodeString(&UnicodeString, 0i64, v6);
  if( !v2 || !v2->Buffer || v2->Length < 2u || !v5 )
  {
    StateRootPath = -1073741811;
    goto LABEL_6;
  }
  StateRootPath = PiGetStateRootPath(L"DriverStatePath");
  if( StateRootPath < 0 )
    goto LABEL_6;
  v9 = v2->Length + 2;
  v10 = v9 + DestinationString.Length;
  if( v10 < v9 )
  {
    StateRootPath = -1073741675;
  }
  else
  {
    if( v10 > 0xFFFE )
    {
      StateRootPath = -2147483643;
      goto LABEL_6;
    }
    StateRootPath = IopAllocateUnicodeString(&UnicodeString, v10);
    if( StateRootPath >= 0 )
    {
      HIDWORD(CreateOptionsa) = HIDWORD(v2);
      RtlUnicodeStringPrintfEx(&UnicodeString, 0i64, 0x800ui64, L"%wZ\\%wZ");
      StateRootPath = v11;
      if( v11 >= 0 )
      {
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.ObjectName = &UnicodeString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v12 = ZwOpenKey(&Handle, 4u, &ObjectAttributes);
        StateRootPath = v12;
        if( v12 != -1073741772 )
          goto LABEL_25;
        ServiceStateSecurityObject = PiAuGetServiceStateSecurityObject(&v17);
        v3 = v17;
        StateRootPath = ServiceStateSecurityObject;
        if( ServiceStateSecurityObject < 0 )
          goto LABEL_6;
        v14 = PiCreateRegistryPath(&DestinationString);
        v4 = v22;
        StateRootPath = v14;
        if( v14 == -1073741772 )
          goto LABEL_24;
        if( v14 < 0 )
          goto LABEL_6;
        LODWORD(CreateOptionsa) = 0;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = v22;
        ObjectAttributes.Attributes = 576;
        ObjectAttributes.ObjectName = v2;
        ObjectAttributes.SecurityDescriptor = v3;
        v12 = ZwCreateKey(&Handle, 4ui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsa, 0i64);
        StateRootPath = v12;
        if( v12 == -1073741772 )
        {
LABEL_24:
          StateRootPath = -1073741595;
        }
        else
        {
LABEL_25:
          if( v12 >= 0 )
          {
            v15 = Handle;
            Handle = 0i64;
            *v5 = v15;
          }
        }
      }
    }
  }
LABEL_6:
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&UnicodeString);
  if( Handle )
    ZwClose(Handle);
  if( v4 )
    ZwClose(v4);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return(unsigned int)StateRootPath;
}

Referenced by: