PipCallbackHasDeviceOverrides

UINT8 __stdcall PipCallbackHasDeviceOverrides(VOID *DeviceOverrideEntryHandle, VOID *Context){
  INT64 v2; 
  NTSTATUS v4; 
  int v5; 
  UINT64 *ResultLength; 
  INT64 v8; 
  VOID *KeyHandle; 
  UINT64 v10; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyInformation; 
  __int128 v13; 
  __int128 v14; 

  ObjectAttributes.RootDirectory = DeviceOverrideEntryHandle;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)Context;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  LODWORD(v10) = 0;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  KeyInformation = 0i64;
  v13 = 0i64;
  v14 = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v2, (INT64)ResultLength, v8, 0i64, v10);
  if( v4 >= 0 )
  {
    v4 = ZwQueryKey(KeyHandle, KeyFullInformation, &KeyInformation, 0x30ui64, &v10);
    if( v4 == -2147483643 )
      v4 = 0;
    if( v4 >= 0 && (v5 = DWORD1(v13)) != 0 )
    {
      *((_QWORD *)Context + 2) = KeyHandle;
      *((_DWORD *)Context + 6) = v5;
    }
    else
    {
      v4 = -1073741823;
      ZwClose((_HANDLE)KeyHandle);
    }
  }
  return v4 >= 0;
}

Referenced by: