PipGetDriverKsrGuid

NTSTATUS __stdcall PipGetDriverKsrGuid(INT64 a1, _GUID *a2){
  _UNICODE_STRING *v3; 
  NTSTATUS v4; 
  INT64 v5; 
  VOID *v6; 
  int DriverKsrGuidRegistryValue; 
  INT64 CreateEnum; 
  INT64 v10; 
  __int128 v11; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 
  VOID *ServiceHandle; 

  v3 = (_UNICODE_STRING *)(*(_QWORD *)(a1 + 48) + 24i64);
  KeyHandle = (VOID *)-1i64;
  ServiceHandle = (VOID *)-1i64;
  v11 = 0i64;
  v4 = PipOpenServiceEnumKeys(v3, 0x20019ui64, &ServiceHandle, 0i64, 0);
  v6 = ServiceHandle;
  DriverKsrGuidRegistryValue = v4;
  if( v4 >= 0 )
  {
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    KeyHandle = 0i64;
    LODWORD(v11) = 1441812;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v11;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = ServiceHandle;
    ObjectAttributes.Attributes = 576;
    DriverKsrGuidRegistryValue = ZwOpenKey(
                                   &KeyHandle,
                                   0x20019ui64,
                                   &ObjectAttributes,
                                   v5,
                                   CreateEnum,
                                   v10,
                                   v11,
                                   (INT64)L"Parameters");
    if( DriverKsrGuidRegistryValue >= 0 )
      DriverKsrGuidRegistryValue = PipGetDriverKsrGuidRegistryValue(KeyHandle, a2);
  }
  if( KeyHandle != (VOID *)-1i64 )
  {
    ZwClose((_HANDLE)KeyHandle);
    KeyHandle = (VOID *)-1i64;
  }
  if( v6 != (VOID *)-1i64 )
    ZwClose((_HANDLE)v6);
  return DriverKsrGuidRegistryValue;
}

Referenced by: