IopSymlinkQueryEnabledClasses
INT64 __stdcall IopSymlinkQueryEnabledClasses(PWCHAR RegistryKeyName){
WCHAR v1;
__int32 v2;
NTSTATUS v3;
WCHAR v4;
WCHAR v5;
WCHAR v6;
WCHAR v7;
unsigned __int16 v8;
ULONG ResultLength;
HANDLE KeyHandle;
struct _UNICODE_STRING DestinationString;
struct _UNICODE_STRING v13;
int v14[2];
struct _UNICODE_STRING v15;
int v16;
struct _UNICODE_STRING v17;
int v18;
struct _UNICODE_STRING v19;
int v20;
char KeyValueInformation[12];
int v22;
KeyHandle = 0i64;
ResultLength = 0;
DestinationString = 0i64;
v2 = 0;
RtlInitUnicodeString(&DestinationString, RegistryKeyName, v1);
v3 = IopOpenRegistryKey(&KeyHandle, 0i64, &DestinationString, 0x20019ui64, 0);
if( v3 >= 0 )
{
RtlInitUnicodeString(&v13, L"SymlinkLocalToLocalEvaluation", v4);
v14[0] = 1;
RtlInitUnicodeString(&v15, L"SymlinkLocalToRemoteEvaluation", v5);
v16 = 2;
RtlInitUnicodeString(&v17, L"SymlinkRemoteToRemoteEvaluation", v6);
v18 = 8;
RtlInitUnicodeString(&v19, L"SymlinkRemoteToLocalEvaluation", v7);
v8 = 0;
v20 = 4;
while( 1 )
{
v3 = ZwQueryValueKey(
KeyHandle,
(struct _UNICODE_STRING *)((char *)&v13 + 24 * v8),
KeyValuePartialInformation,
KeyValueInformation,
0x14u,
&ResultLength);
if( v3 < 0 )
break;
if( v22 )
v2 += v14[6 * v8];
if( ++v8 >= 4u )
{
_InterlockedExchange(&IopSymlinkEnabledTypes, v2);
break;
}
}
}
if( KeyHandle )
ZwClose(KeyHandle);
return(unsigned int)v3;
}Referenced by:
IopSymlinkRegistryCallback