IopSymlinkQueryEnabledClasses

INT64 __stdcall IopSymlinkQueryEnabledClasses(PWCHAR RegistryKeyName){
  WCHAR v1; 
  __int32 v2; 
  NTSTATUS v3; 
  WCHAR v4; 
  WCHAR v5; 
  WCHAR v6; 
  WCHAR v7; 
  unsigned __int16 v8; 
  ULONG ResultLength; 
  HANDLE KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING v13; 
  int v14[2]; 
  struct _UNICODE_STRING v15; 
  int v16; 
  struct _UNICODE_STRING v17; 
  int v18; 
  struct _UNICODE_STRING v19; 
  int v20; 
  char KeyValueInformation[12]; 
  int v22; 
  KeyHandle = 0i64;
  ResultLength = 0;
  DestinationString = 0i64;
  v2 = 0;
  RtlInitUnicodeString(&DestinationString, RegistryKeyName, v1);
  v3 = IopOpenRegistryKey(&KeyHandle, 0i64, &DestinationString, 0x20019ui64, 0);
  if( v3 >= 0 )
  {
    RtlInitUnicodeString(&v13, L"SymlinkLocalToLocalEvaluation", v4);
    v14[0] = 1;
    RtlInitUnicodeString(&v15, L"SymlinkLocalToRemoteEvaluation", v5);
    v16 = 2;
    RtlInitUnicodeString(&v17, L"SymlinkRemoteToRemoteEvaluation", v6);
    v18 = 8;
    RtlInitUnicodeString(&v19, L"SymlinkRemoteToLocalEvaluation", v7);
    v8 = 0;
    v20 = 4;
    while( 1 )
    {
      v3 = ZwQueryValueKey(
             KeyHandle,
             (struct _UNICODE_STRING *)((char *)&v13 + 24 * v8),
             KeyValuePartialInformation,
             KeyValueInformation,
             0x14u,
             &ResultLength);
      if( v3 < 0 )
        break;
      if( v22 )
        v2 += v14[6 * v8];
      if( ++v8 >= 4u )
      {
        _InterlockedExchange(&IopSymlinkEnabledTypes, v2);
        break;
      }
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
  return(unsigned int)v3;
}

Referenced by:

IopSymlinkRegistryCallback