PiDevCfgPushCopyKeyEntry

INT64 __stdcall PiDevCfgPushCopyKeyEntry(
        _LIST_ENTRY *CopyKeyStack,
        PVOID SourceKeyHandle,
        PVOID TargetKeyHandle,
        UINT64 Flags){
  NTSTATUS v4; 
  int v8; 
  _LIST_ENTRY *PoolWithTag; 
  _LIST_ENTRY *v10; 
  void **p_Flink; 
  _LIST_ENTRY *Blink; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  v4 = 0;
  v8 = Flags;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  PoolWithTag = (_LIST_ENTRY *)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x63647050ui64);
  v10 = PoolWithTag;
  if( !PoolWithTag )
    return(unsigned int)-1073741670;
  LODWORD(PoolWithTag[2].Flink) = v8;
  p_Flink = (void **)&PoolWithTag[1].Flink;
  if( v8 >= 0 )
  {
    *p_Flink = SourceKeyHandle;
    PoolWithTag[1].Blink = (_LIST_ENTRY *)TargetKeyHandle;
LABEL_4:
    Blink = CopyKeyStack->Blink;
    if( Blink->Flink != CopyKeyStack )
      __fastfail(3u);
    v10->Flink = CopyKeyStack;
    v10->Blink = Blink;
    Blink->Flink = v10;
    CopyKeyStack->Blink = v10;
    v10 = 0i64;
    goto LABEL_6;
  }
  ObjectAttributes.RootDirectory = SourceKeyHandle;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&PiDevCfgEmptyString;
  ObjectAttributes.Attributes = 512;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(p_Flink, 0x20019u, &ObjectAttributes);
  if( v4 >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&PiDevCfgEmptyString;
    ObjectAttributes.RootDirectory = TargetKeyHandle;
    ObjectAttributes.Attributes = 512;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v4 = ZwOpenKey((PHANDLE)&v10[1].Blink, 0xF003Fu, &ObjectAttributes);
    if( v4 >= 0 )
    {
      LODWORD(v10[2].Flink) |= 0x40000000u;
      goto LABEL_4;
    }
    ZwClose(*p_Flink);
  }
LABEL_6:
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  return(unsigned int)v4;
}

Referenced by: