PiCMOpenDeviceInterfaceKey

NTSTATUS __stdcall PiCMOpenDeviceInterfaceKey(
        VOID *IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        VOID *IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  UINT64 *v5; 
  unsigned int v6; 
  char PreviousMode; 
  NTSTATUS v9; 
  UINT64 v10; 
  const WCHAR *v11; 
  unsigned int v12; 
  UINT64 v13; 
  NTSTATUS v14; 
  UINT64 v15; 
  NTSTATUS v16; 
  VOID **DesiredAccess; 
  INT64 Create; 
  INT64 Createa; 
  VOID **DeviceInterfaceKey; 
  UINT64 *Disposition; 
  VOID *Handle; 
  __int128 v24; 
  INT64 v25[2]; 
  UINT64 ExpectedOutputSize[2]; 
  PVOID SourceHandle; 

  v5 = (UINT64 *)SourceHandle;
  v6 = IoctlOutputBufferSize;
  Handle = 0i64;
  SourceHandle = 0i64;
  *(_DWORD *)v5 = 0;
  v24 = 0i64;
  *(_OWORD *)v25 = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  *(_OWORD *)ExpectedOutputSize = 0i64;
  v9 = PiCMCaptureRegistryInputData(IoctlInputBuffer, IoctlInputBufferSize, (int)BytesUsed, (__int64)&v24);
  if( v9 < 0 )
    goto LABEL_21;
  v11 = (const WCHAR *)v25[0];
  if( !v25[0]
    || *(_QWORD *)((char *)&v24 + 4) != 0x400000000i64
    || HIDWORD(ExpectedOutputSize[0])
    || !IoctlOutputBuffer
    || v6 < 0x10 )
  {
    v14 = -1073741811;
    goto LABEL_15;
  }
  v12 = HIDWORD(v25[1]);
  LOBYTE(Create) = 0;
  LODWORD(DesiredAccess) = HIDWORD(v25[1]);
  v14 = CmOpenDeviceInterfaceRegKey(
          *(&stru_140CF2E80 + 607),
          (const WCHAR *)v25[0],
          50i64,
          v10,
          (INT64)DesiredAccess,
          Create,
          &SourceHandle,
          0i64);
  if( v14 != -1073741772 )
    goto LABEL_12;
  if( LODWORD(ExpectedOutputSize[0]) == 1 )
  {
    if( !PiAuDoesClientHaveAccess(2ui64) )
    {
      v14 = -1073741790;
      goto LABEL_15;
    }
    LOBYTE(Createa) = 1;
    LODWORD(DesiredAccess) = v12;
    v14 = CmOpenDeviceInterfaceRegKey(
            *(&stru_140CF2E80 + 607),
            v11,
            50i64,
            v15,
            (INT64)DesiredAccess,
            Createa,
            &SourceHandle,
            0i64);
LABEL_12:
    if( v14 >= 0 )
    {
      DesiredAccess = &Handle;
      PiCMDuplicateRegistryHandle(SourceHandle, v13, (UINT64 *)v12, PreviousMode);
      v14 = v16;
    }
  }
LABEL_15:
  LODWORD(DesiredAccess) = v6;
  v9 = PiCMReturnHandleResultData(
         (unsigned int)v14,
         Handle,
         LODWORD(ExpectedOutputSize[1]),
         IoctlOutputBuffer,
         (UINT64)DesiredAccess,
         v5,
         (INT64)DeviceInterfaceKey,
         (INT64)Disposition);
  if( SourceHandle )
    ZwClose((_HANDLE)SourceHandle);
  if( v9 < 0 || v14 < 0 )
  {
    if( Handle )
      ObCloseHandle(Handle, PreviousMode);
  }
LABEL_21:
  PiCMReleaseRegistryInputData((__int64)&v24);
  return v9;
}

Referenced by: