KGetAppModelStateSeparatedRegKeyPath
NTSTATUS __stdcall KGetAppModelStateSeparatedRegKeyPath(PCWSTR SourceString){
_WORD *v1;
UNICODE_STRING *v2;
UNICODE_STRING *v3;
_WORD *v4;
int PersistedStateLocation;
NTSTATUS inited;
int v8;
VOID *PoolWithTag;
UINT64 v11;
UINT64 v12;
SIZE_T NumberOfBytes;
v3 = v2;
LODWORD(NumberOfBytes) = 0;
v4 = v1;
if( !v2 )
return -1073741811;
LODWORD(v11) = 0;
PersistedStateLocation = RtlGetPersistedStateLocation(
(WCHAR *)SourceString,
L"TargetNtPath",
v1,
0i64,
0i64,
v11,
&NumberOfBytes);
inited = PersistedStateLocation;
if( PersistedStateLocation >= 0 )
return -1073741823;
if( PersistedStateLocation == -2147483643 )
{
v8 = NumberOfBytes;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x4D707041ui64);
if( PoolWithTag )
{
LODWORD(v12) = v8;
inited = RtlGetPersistedStateLocation(
(WCHAR *)SourceString,
L"TargetNtPath",
v4,
0i64,
PoolWithTag,
v12,
&NumberOfBytes);
if( inited >= 0 )
{
inited = RtlInitUnicodeStringEx(v3, (WCHAR *)PoolWithTag);
if( inited >= 0 )
PoolWithTag = 0i64;
}
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x4D707041u);
}
else
{
return -1073741670;
}
}
return inited;
}Referenced by:
KIsSideloadingEnabled
KIsUnlockSettingEnabled