PipDmgInitReadGroupPolicy

NTSTATUS __stdcall PipDmgInitReadGroupPolicy(){
  INT64 v0; 
  NTSTATUS v1; 
  NTSTATUS RegistryValue; 
  _KEY_VALUE_FULL_INFORMATION *v3; 
  int v4; 
  int v5; 
  __int64 v7; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 
  _KEY_VALUE_FULL_INFORMATION *Information; 

  Information = 0i64;
  v1 = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  KeyHandle = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v7;
  ObjectAttributes.Attributes = 576;
  if( ZwOpenKey(
         &KeyHandle,
         0x20019ui64,
         &ObjectAttributes,
         v0,
         9961622i64,
         (INT64)L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection",
         48i64,
         0i64) >= 0 )
  {
    RegistryValue = IopGetRegistryValue(KeyHandle, (PWCHAR)L"DeviceEnumerationPolicy", 0i64, &Information);
    v3 = Information;
    if( RegistryValue >= 0 && PnpValidateRegistryDword((__int64)Information) )
    {
      v4 = *(ULONG *)((char *)&v3->TitleIndex + v3->DataOffset);
      if( v4 )
      {
        v5 = v4 - 1;
        if( v5 )
        {
          if( v5 == 1 )
            v1 = 1;
        }
        else
        {
          v1 = 2;
        }
      }
      else
      {
        v1 = 3;
      }
    }
    if( v3 )
      ExFreePoolWithTag(v3, 0);
  }
  if( KeyHandle != (VOID *)-1i64 )
    ZwClose((_HANDLE)KeyHandle);
  return v1;
}

Referenced by: