PnpOpenFirstMatchingSubKey

NTSTATUS __fastcall PnpOpenFirstMatchingSubKey(WCHAR *SourceString, INT64 a2, WCHAR a3, __int64 a4, VOID **KeyHandle){
  WCHAR *v6; 
  NTSTATUS result; 
  INT64 v8; 
  __int64 v9; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  v6 = SourceString;
  DestinationString = 0i64;
  if( !SourceString || !a2 || !KeyHandle )
    return -1073741811;
  *KeyHandle = 0i64;
  result = -1073741772;
  if( *SourceString )
  {
    do
    {
      RtlInitUnicodeString(&DestinationString, v6);
      *(_QWORD *)&ObjectAttributes.Length = 48i64;
      ObjectAttributes.ObjectName = &DestinationString;
      *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
      *KeyHandle = 0i64;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      result = ZwOpenKey(
                 KeyHandle,
                 0x20019ui64,
                 &ObjectAttributes,
                 v8,
                 *(INT64 *)&DestinationString.Length,
                 (INT64)DestinationString.Buffer,
                 *(INT64 *)&ObjectAttributes.Length,
                 a2);
      if( result >= 0 )
        break;
      *KeyHandle = 0i64;
      v9 = -1i64;
      do
        ++v9;
      while( v6[v9] );
      v6 += v9 + 1;
    }
    while( *v6 );
  }
  return result;
}

Referenced by: