IopSymlinkQueryEnabledClasses

NTSTATUS __stdcall IopSymlinkQueryEnabledClasses(WCHAR *RegistryKeyName){
  __int32 v1; 
  int v2; 
  unsigned __int16 v3; 
  UINT64 Create; 
  UINT64 ResultLength; 
  PVOID Handle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v9; 
  int v10[2]; 
  _UNICODE_STRING v11; 
  int v12; 
  _UNICODE_STRING v13; 
  int v14; 
  _UNICODE_STRING v15; 
  int v16; 
  char KeyValueInformation[12]; 
  int v18; 

  Handle = 0i64;
  LODWORD(ResultLength) = 0;
  DestinationString = 0i64;
  v1 = 0;
  RtlInitUnicodeString(&DestinationString, RegistryKeyName);
  v2 = IopOpenRegistryKey(&Handle, 0i64, &DestinationString, 0x20019ui64, 0);
  if( v2 >= 0 )
  {
    RtlInitUnicodeString(&v9, L"SymlinkLocalToLocalEvaluation");
    v10[0] = 1;
    RtlInitUnicodeString(&v11, L"SymlinkLocalToRemoteEvaluation");
    v12 = 2;
    RtlInitUnicodeString(&v13, L"SymlinkRemoteToRemoteEvaluation");
    v14 = 8;
    RtlInitUnicodeString(&v15, L"SymlinkRemoteToLocalEvaluation");
    v3 = 0;
    v16 = 4;
    while( 1 )
    {
      LODWORD(Create) = 20;
      v2 = ZwQueryValueKey(
             Handle,
             (_UNICODE_STRING *)((char *)&v9 + 24 * v3),
             KeyValuePartialInformation,
             KeyValueInformation,
             Create,
             &ResultLength);
      if( v2 < 0 )
        break;
      if( v18 )
        v1 += v10[6 * v3];
      if( ++v3 >= 4u )
      {
        _InterlockedExchange((_DWORD *)&stru_140CF2E80 + 1202, v1);
        break;
      }
    }
  }
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return v2;
}

Referenced by: