IopOpenRegistryKey
NTSTATUS __stdcall IopOpenRegistryKey(
PVOID *Handle,
PVOID BaseHandle,
_UNICODE_STRING *KeyName,
UINT64 DesiredAccess,
UINT8 Create){
_UNICODE_STRING *Class;
UINT64 CreateOptions;
UINT64 *Disposition;
INT64 v9;
_OBJECT_ATTRIBUTES v10;
UINT64 v11;
v10.ObjectName = KeyName;
*(_QWORD *)&v10.Length = 48i64;
*(_QWORD *)&v10.Attributes = 576i64;
v10.RootDirectory = BaseHandle;
LODWORD(v11) = 0;
*(_OWORD *)&v10.SecurityDescriptor = 0i64;
if( !Create )
return ZwOpenKey(
Handle,
(unsigned int)DesiredAccess,
&v10,
0i64,
(INT64)Class,
CreateOptions,
(INT64)Disposition,
v9);
LODWORD(CreateOptions) = 1;
return ZwCreateKey(Handle, (unsigned int)DesiredAccess, &v10, 0i64, 0i64, CreateOptions, &v11);
}Referenced by:
IoQueryDeviceDescription
IopAllowRemoteDASD
IopBootLog
IopCopyBootLogRegistryToFile
IopInitializeOfflineCrashDump
IopIsBitlockerOn
IopLiveDumpInitRegistrySettings
IopLoadUnloadDriver
IopReadDumpRegistry
IopRegistryOpenDeepestPath
IopSafebootDriverLoad
IopSymlinkQueryEnabledClasses
IopUnloadDriver
SecureDump_ReadRegistry
pIoQueryBusDescription
pIoQueryDeviceDescription