KsepRegistryOpenKey

NTSTATUS __stdcall KsepRegistryOpenKey(PWCHAR EnginePath, PWCHAR SearchKey, PVOID *Handle){
  NTSTATUS v6; 
  INT64 v7; 
  int v8; 
  __int64 v10; 
  __int64 v11; 
  _UNICODE_STRING ResultString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 

  *(_QWORD *)&ResultString.Length = 0i64;
  ResultString.Buffer = 0i64;
  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( !EnginePath )
  {
    v10 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v10 + 1] = -1073740768;
    KsepHistoryErrors[2 * v10] = 262566;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("EnginePath != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 422i64, 0i64);
  }
  if( !Handle )
  {
    v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v11 + 1] = -1073740768;
    KsepHistoryErrors[2 * v11] = 262567;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("Handle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 423i64, 0i64);
  }
  if( SearchKey )
    v6 = KsepStringConcatenate(&ResultString, EnginePath, SearchKey, 1ui64);
  else
    v6 = KsepStringDuplicate(&ResultString, EnginePath);
  v8 = v6;
  if( v6 >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &ResultString;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v8 = ZwOpenKey(
           &KeyHandle,
           0x20019ui64,
           &ObjectAttributes,
           v7,
           *(INT64 *)&ResultString.Length,
           (INT64)ResultString.Buffer,
           *(INT64 *)&ObjectAttributes.Length,
           0i64);
    if( v8 >= 0 )
    {
      *Handle = KeyHandle;
      _InterlockedIncrement(&dword_140C2A7F8);
    }
  }
  KsepStringFree(&ResultString);
  return v8;
}

Referenced by: