RtlpGetBootStatusPath
CHAR __fastcall RtlpGetBootStatusPath(UINT8 **a1, CHAR *a2, WCHAR a3){
int BootStatusPathFromRegistry;
CHAR v6;
wchar_t *v7;
BootStatusPathFromRegistry = RtlpGetBootStatusPathFromRegistry(a1, (INT64)a2, a3);
v6 = 0;
if( BootStatusPathFromRegistry >= 0 )
{
v6 = 1;
}
else
{
LOBYTE(BootStatusPathFromRegistry) = RtlIsStateSeparationEnabled();
v7 = L"\\OSDataRoot\\Windows\\bootstat.dat";
if( !(_BYTE)BootStatusPathFromRegistry )
v7 = L"\\SystemRoot\\bootstat.dat";
*a1 = (UINT8 *)v7;
}
*a2 = v6;
return BootStatusPathFromRegistry;
}Referenced by:
RtlLockBootStatusData