BiCleanupLoadedStores

VOID __stdcall BiCleanupLoadedStores(UINT64 Flags){
  char v1; 
  UINT8 IsWinPEBoot; 
  const wchar_t **v3; 
  __int64 v4; 
  UINT8 IsSystemStore; 
  void *P[2]; 
  UINT64 SubKeyCount; 
  PVOID StoreHandle; 
  HANDLE Handle; 
  StoreHandle = 0i64;
  v1 = Flags;
  LODWORD(SubKeyCount) = 0;
  P[0] = 0i64;
  Handle = 0i64;
  IsWinPEBoot = BiIsWinPEBoot();
  if( (int)BiOpenKeyNonBcd(0i64, (WCHAR *)L"\\Registry\\Machine", 0xF003Fui64, &Handle) >= 0 )
  {
    if( (int)BiEnumerateSubKeys(Handle, (WCHAR ***)P, &SubKeyCount) >= 0 && (_DWORD)SubKeyCount )
    {
      v3 = (const wchar_t **)P[0];
      v4 = (unsigned int)SubKeyCount;
      do
      {
        if( !wcsnicmp(*v3, L"BCD", 3ui64)
          && (unsigned int)wcstoul(*v3 + 3, 0i64, 10i64) != -1
          && (int)BiOpenKey(Handle, (WCHAR *)*v3, 0x20019ui64, &StoreHandle) >= 0 )
        {
          IsSystemStore = BiIsSystemStore(StoreHandle);
          if( (v1 & 0x10) != 0 && IsSystemStore )
          {
            BcdForciblyUnloadStore(StoreHandle);
          }
          else if( (v1 & 8) != 0 || IsWinPEBoot || !IsSystemStore )
          {
            BiUnloadHiveByHandle(StoreHandle, 0);
          }
          else
          {
            BiCloseKey(StoreHandle);
          }
        }
        ++v3;
        --v4;
      }
      while( v4 );
    }
    if( P[0] )
      ExFreePoolWithTag(P[0], 0x4B444342u);
  }
  if( Handle )
    ZwClose(Handle);
}

Referenced by: