PiDrvDbLoadHive

NTSTATUS __stdcall PiDrvDbLoadHive(_UNICODE_STRING *HiveKeyPath, _UNICODE_STRING *HiveFileName, VOID **RootKeyHandle){
  VOID **v3; 
  VOID **v4; 
  int v5; 
  INT64 v6; 
  INT64 v8; 
  UINT64 v9; 
  INT64 v10; 
  INT64 v11; 
  INT64 v12; 
  _OBJECT_ATTRIBUTES TargetKey; 
  _OBJECT_ATTRIBUTES SourceFile; 

  v4 = v3;
  *v3 = 0i64;
  LODWORD(v9) = 0;
  LODWORD(RootKeyHandle) = (unsigned int)RootKeyHandle | 0x80;
  *(_OWORD *)&TargetKey.Length = 0x30ui64;
  *(_OWORD *)&SourceFile.Length = 0x30ui64;
  TargetKey.ObjectName = HiveKeyPath;
  SourceFile.ObjectName = HiveFileName;
  *(_QWORD *)&TargetKey.Attributes = 576i64;
  *(_OWORD *)&TargetKey.SecurityDescriptor = 0i64;
  *(_QWORD *)&SourceFile.Attributes = 576i64;
  *(_OWORD *)&SourceFile.SecurityDescriptor = 0i64;
  v5 = ZwLoadKeyEx(&TargetKey, &SourceFile, (UINT64)RootKeyHandle, 0i64, 0i64, v9, 0i64, 0i64);
  if( v5 >= 0 )
  {
    v5 = ZwOpenKey(v4, 0x2000000ui64, &TargetKey, v6, v8, v10, v11, v12);
    if( v5 < 0 )
      ZwUnloadKey2(&TargetKey, 0i64);
  }
  return v5;
}

Referenced by: