PipCheckForDenyExecute

UINT8 __stdcall PipCheckForDenyExecute(PWCHAR InterfaceClass){
  WCHAR *v2; 
  bool v3; 
  WCHAR v4; 
  int v5; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PCWSTR SourceString; 
  void *KeyHandle; 
  PVOID P; 
  P = 0i64;
  KeyHandle = 0i64;
  v2 = 0i64;
  SourceString = 0i64;
  DestinationString = 0i64;
  v3 = 0;
  if( wcsicmp(L"{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", InterfaceClass) )
  {
    PnpConcatPWSTR(
      0x200ui64,
      0x47706E50ui64,
      (WCHAR **)&SourceString,
      3ui64,
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Storage",
      L"\\",
      InterfaceClass);
    v2 = (WCHAR *)SourceString;
    if( v5 >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, SourceString, v4);
      *(&ObjectAttributes.Length + 1) = 0;
      memset(&ObjectAttributes.Attributes + 1, 0, 20);
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.Attributes = 576;
      if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
      {
        if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"Deny_Execute", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
        {
          if( !P )
            goto LABEL_11;
          if( *((_DWORD *)P + 1) == 4 && *((_DWORD *)P + 3) == 4 )
            v3 = *(_DWORD *)((char *)P + *((unsigned int *)P + 2)) != 0;
        }
        if( P )
          ExFreePoolWithTag(P, 0);
      }
    }
  }
LABEL_11:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( v2 )
    ExFreePoolWithTag(v2, 0x47706E50u);
  return v3;
}

Referenced by: