PipCheckForDenyExecute

UINT8 __stdcall PipCheckForDenyExecute(WCHAR *InterfaceClass){
  WCHAR *v2; 
  bool v3; 
  int v4; 
  INT64 v5; 
  INT64 v7; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR *SourceString; 
  VOID *KeyHandle; 
  _KEY_VALUE_FULL_INFORMATION *Information; 

  Information = 0i64;
  KeyHandle = 0i64;
  v2 = 0i64;
  SourceString = 0i64;
  DestinationString = 0i64;
  v3 = 0;
  if( wcsicmp(L"{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", InterfaceClass) )
  {
    v4 = PnpConcatPWSTR(0x200ui64, 0x47706E50u, (PVOID *)&SourceString, 3ui64);
    v2 = SourceString;
    if( v4 >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, SourceString);
      *(&ObjectAttributes.Length + 1) = 0;
      memset(&ObjectAttributes.Attributes + 1, 0, 20);
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.Attributes = 576;
      if( ZwOpenKey(
             &KeyHandle,
             0x20019ui64,
             &ObjectAttributes,
             v5,
             (INT64)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Storage",
             (INT64)L"\\",
             (INT64)InterfaceClass,
             v7) >= 0 )
      {
        if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"Deny_Execute", 0i64, &Information) >= 0 )
        {
          if( !Information )
            goto LABEL_11;
          if( Information->Type == 4 && Information->DataLength == 4 )
            v3 = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset) != 0;
        }
        if( Information )
          ExFreePoolWithTag(Information, 0);
      }
    }
  }
LABEL_11:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  if( v2 )
    ExFreePoolWithTag(v2, 0x47706E50u);
  return v3;
}

Referenced by: