PspReadIFEONodeOptions
__int64 __fastcall PspReadIFEONodeOptions(__int64 a1, void *a2, __int64 *a3){
__int64 result;
UINT64 v6;
unsigned int v7;
v7 = 0;
LODWORD(v6) = 4;
result = RtlQueryImageFileKeyOption(a2, L"NodeOptions", 4ui64, &v7, v6, 0i64);
if( (int)result >= 0 )
{
result = v7;
if( (_BYTE)v7 )
{
if( (unsigned __int8)v7 == 1 && v7 >> 8 < (unsigned __int16)KeNumberNodes && !*a3 )
{
result = *((_QWORD *)&KeNodeBlock + ((unsigned __int64)v7 >> 8));
if( *(_QWORD *)(result + 136) )
*a3 = result;
}
}
else if( (v7 & 0xFFFFFF00) != 0 )
{
*(_DWORD *)(a1 + 1120) |= 0x100000u;
}
}
return result;
}Referenced by:
PspAllocateProcess