IopOpenSystemVariableDevice
NTSTATUS __stdcall IopOpenSystemVariableDevice(
PFILE_OBJECT *FileObject,
PDEVICE_OBJECT *DeviceObject,
VOID ***FunctionTable){
int DeviceObjectPointer;
VOID **v7;
int v8;
WCHAR *v9;
NTSTATUS v10;
_UNICODE_STRING DestinationString[2];
WCHAR *SourceString;
DestinationString[0] = 0i64;
if( (*(&stru_140C452E0 + 608) & 1) != 0 )
{
RtlInitUnicodeString(DestinationString, L"\\Device\\WindowsTrustedRT\\{699AA2F1-A42E-40DF-BABE-3AAAD2BB6A47}");
DeviceObjectPointer = IoGetDeviceObjectPointer(DestinationString, 0x10000000ui64, FileObject, DeviceObject);
if( DeviceObjectPointer >= 0 )
{
LABEL_3:
v7 = (VOID **)&IopSysEnvFunctionTableTrEE;
LABEL_13:
*FunctionTable = v7;
return DeviceObjectPointer;
}
goto LABEL_8;
}
SourceString = 0i64;
IopGetDeviceInterfaces(&GUID_EFI_VARIABLE_SERVICE, 0i64, 0i64, 0, &SourceString, 0i64);
if( v8 < 0 || (v9 = SourceString, !*SourceString) )
{
LABEL_8:
RtlInitUnicodeString(DestinationString, L"\\Device\\SysEnv");
v10 = IoGetDeviceObjectPointer(DestinationString, 0x10000000ui64, FileObject, DeviceObject);
DeviceObjectPointer = v10;
if( v10 >= 0 )
{
v7 = &IopSysEnvFunctionTableSysEnv;
goto LABEL_13;
}
if( (unsigned int)(v10 + 1073741773) <= 1 || v10 == -1073741766 )
{
*FileObject = 0i64;
v7 = &IopSysEnvFunctionTableHal;
*DeviceObject = 0i64;
DeviceObjectPointer = 0;
goto LABEL_13;
}
return DeviceObjectPointer;
}
RtlInitUnicodeString(DestinationString, SourceString);
DeviceObjectPointer = IoGetDeviceObjectPointer(DestinationString, 0x10000000ui64, FileObject, DeviceObject);
ExFreePoolWithTag(v9, 0);
if( DeviceObjectPointer >= 0 )
goto LABEL_3;
return DeviceObjectPointer;
}Referenced by:
IoEnumerateEnvironmentVariablesEx
IoGetEnvironmentVariableEx
IoQueryEnvironmentVariableInfoEx
IoSetEnvironmentVariableEx