KGetAppModelStateSeparatedRegKeyPath
NTSTATUS __stdcall KGetAppModelStateSeparatedRegKeyPath(PCWSTR SourceString){
_WORD *v1;
_UNICODE_STRING *v2;
_UNICODE_STRING *v3;
_WORD *v4;
NTSTATUS PersistedStateLocation;
int inited;
int v8;
VOID **a5;
INT64 a6;
INT64 a6a;
UINT64 NumberOfBytes;
v3 = v2;
LODWORD(NumberOfBytes) = 0;
v4 = v1;
if( !v2 )
return -1073741811;
LODWORD(a6) = 0;
PersistedStateLocation = RtlGetPersistedStateLocation(
(WCHAR *)SourceString,
L"TargetNtPath",
v1,
0i64,
0i64,
a6,
(INT64)&NumberOfBytes);
inited = PersistedStateLocation;
if( PersistedStateLocation >= 0 )
return -1073741823;
if( PersistedStateLocation == -2147483643 )
{
v8 = NumberOfBytes;
a5 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1299214401i64);
if( a5 )
{
LODWORD(a6a) = v8;
inited = RtlGetPersistedStateLocation(
(WCHAR *)SourceString,
L"TargetNtPath",
v4,
0i64,
a5,
a6a,
(INT64)&NumberOfBytes);
if( inited >= 0 )
{
inited = RtlInitUnicodeStringEx(v3, (WCHAR *)a5);
if( inited >= 0 )
a5 = 0i64;
}
if( a5 )
ExFreePoolWithTag(a5, 0x4D707041u);
}
else
{
return -1073741670;
}
}
return inited;
}Referenced by:
KIsSideloadingEnabled
KIsUnlockSettingEnabled