PfpGetParameter
NTSTATUS __stdcall PfpGetParameter(
VOID *ParametersKey,
WCHAR *ValueNameBuffer,
UINT64 ValueType,
VOID *Value,
UINT64 *ValueSize){
int v7;
NTSTATUS result;
size_t v9;
UINT64 Length;
UINT64 ResultLength;
_UNICODE_STRING DestinationString;
char KeyValueInformation[4];
int v14;
size_t Src;
int Src_4;
LODWORD(ResultLength) = 272;
DestinationString = 0i64;
v7 = ValueType;
RtlInitUnicodeString(&DestinationString, ValueNameBuffer);
if( !ParametersKey )
return -1073741811;
LODWORD(Length) = 272;
result = ZwQueryValueKey(
ParametersKey,
&DestinationString,
KeyValuePartialInformation,
KeyValueInformation,
Length,
&ResultLength);
if( result >= 0 )
{
if( (unsigned int)ResultLength < 0x10 )
{
return -1073741823;
}
else if( v14 == v7 )
{
v9 = Src;
if( Src > *(_DWORD *)ValueSize )
{
return -1073741789;
}
else
{
memmove(Value, &Src_4, Src);
result = 0;
*(_DWORD *)ValueSize = v9;
}
}
else
{
return -1073741788;
}
}
return result;
}Referenced by:
PfSnParametersRead
PfpParametersInitialize
PfpParametersRead
PfpSetBaseTime