IopReadDumpRegistry
VOID __stdcall IopReadDumpRegistry(UINT64 *dumpSetting, UINT64 a2){
PVOID v3;
UNICODE_STRING KeyName;
PVOID P;
HANDLE Handle;
Handle = 0i64;
P = 0i64;
KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl";
*(_QWORD *)&KeyName.Length = 8388734i64;
if( IopOpenRegistryKey(&Handle, 0i64, &KeyName, 0x20019ui64, 0) >= 0 )
{
if( IopGetRegistryValue(Handle, (PWCHAR)L"AutoReboot", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
{
if( *((_DWORD *)P + 3) )
IopAutoReboot = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
ExFreePoolWithTag(P, 0);
}
if( a2 && IopGetRegistryValue(Handle, (PWCHAR)L"CrashDumpEnabled", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
{
v3 = P;
if( *((_DWORD *)P + 3) )
*(_DWORD *)a2 = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
ExFreePoolWithTag(v3, 0);
}
ObCloseHandle(Handle, 0);
}
}Referenced by:
IoConfigureCrashDump
IopInitializeCrashDump