ExpWnfDeletePermanentStateData
NTSTATUS __stdcall ExpWnfDeletePermanentStateData(_WNF_SCOPE_INSTANCE *ScopeInstance, _WNF_STATE_NAME_STRUCT StateName){
unsigned __int64 v3;
unsigned __int64 v4;
int v5;
NTSTATUS result;
_OBJECT_TYPE *v7;
VOID *PermanentDataStore;
_UNICODE_STRING ValueName;
char v10;
PermanentDataStore = 0i64;
*(_QWORD *)&ValueName.Length = 2228224i64;
v3 = ((unsigned __int64)StateName._bf_0 >> 4) & 3;
v4 = ((unsigned __int64)StateName._bf_0 >> 6) & 0xF;
ValueName.Buffer = (wchar_t *)&v10;
ExpWnfComposeValueName(StateName, &ValueName);
v5 = 0;
if( ScopeInstance )
result = ExpWnfGetPermanentDataStoreHandle(ScopeInstance, (_WNF_STATE_NAME_LIFETIME)v3, 0i64, &PermanentDataStore);
else
result = ExpWnfEnumeratePermanentDataStores(
(_WNF_DATA_SCOPE)v4,
(_WNF_STATE_NAME_LIFETIME)v3,
0i64,
&PermanentDataStore);
if( result >= 0 )
{
while( 1 )
{
result = ZwDeleteValueKey(PermanentDataStore, &ValueName, v7);
if( ScopeInstance )
break;
ZwClose((_HANDLE)PermanentDataStore);
if( ExpWnfEnumeratePermanentDataStores(
(_WNF_DATA_SCOPE)v4,
(_WNF_STATE_NAME_LIFETIME)v3,
(unsigned int)++v5,
&PermanentDataStore) < 0 )
return 0;
}
}
return result;
}Referenced by:
ExpNtDeleteWnfStateData
NtDeleteWnfStateName