IopOpenSystemVariableDevice
__int64 __fastcall IopOpenSystemVariableDevice(PFILE_OBJECT *FileObject, PDEVICE_OBJECT *DeviceObject, void ***a3){
NTSTATUS DeviceObjectPointer;
WCHAR v7;
void **v8;
int v9;
WCHAR *v10;
NTSTATUS v11;
struct _UNICODE_STRING DestinationString;
PCWSTR SourceString;
DestinationString = 0i64;
if( (IopSysEnvOverrideFlags & 1) != 0 )
{
RtlInitUnicodeString(
&DestinationString,
L"\\Device\\WindowsTrustedRT\\{699AA2F1-A42E-40DF-BABE-3AAAD2BB6A47}",
(WCHAR)a3);
DeviceObjectPointer = IoGetDeviceObjectPointer(&DestinationString, 0x10000000ui64, FileObject, DeviceObject);
if( DeviceObjectPointer >= 0 )
{
LABEL_3:
v8 = &IopSysEnvFunctionTableTrEE;
LABEL_13:
*a3 = v8;
return(unsigned int)DeviceObjectPointer;
}
goto LABEL_8;
}
SourceString = 0i64;
IopGetDeviceInterfaces(&GUID_EFI_VARIABLE_SERVICE, 0i64, 0i64, 0, (WCHAR **)&SourceString, 0i64);
if( v9 < 0 || (v10 = (WCHAR *)SourceString, !*SourceString) )
{
LABEL_8:
RtlInitUnicodeString(&DestinationString, L"\\Device\\SysEnv", v7);
v11 = IoGetDeviceObjectPointer(&DestinationString, 0x10000000ui64, FileObject, DeviceObject);
DeviceObjectPointer = v11;
if( v11 >= 0 )
{
v8 = &IopSysEnvFunctionTableSysEnv;
goto LABEL_13;
}
if( (unsigned int)(v11 + 1073741773) <= 1 || v11 == -1073741766 )
{
*FileObject = 0i64;
v8 = (void **)&IopSysEnvFunctionTableHal;
*DeviceObject = 0i64;
DeviceObjectPointer = 0;
goto LABEL_13;
}
return(unsigned int)DeviceObjectPointer;
}
RtlInitUnicodeString(&DestinationString, SourceString, v7);
DeviceObjectPointer = IoGetDeviceObjectPointer(&DestinationString, 0x10000000ui64, FileObject, DeviceObject);
ExFreePoolWithTag(v10, 0);
if( DeviceObjectPointer >= 0 )
goto LABEL_3;
return(unsigned int)DeviceObjectPointer;
}Referenced by:
IoEnumerateEnvironmentVariablesEx
IoGetEnvironmentVariableEx
IoQueryEnvironmentVariableInfoEx
IoSetEnvironmentVariableEx