RtlOpenCurrentUser

INT64 __stdcall RtlOpenCurrentUser(UINT64 DesiredAccess, PVOID *CurrentUserKey){
  ACCESS_MASK v2; 
  int v4; 
  WCHAR v5; 
  struct _UNICODE_STRING KeyPath; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  v2 = DesiredAccess;
  KeyPath = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v4 = RtlFormatCurrentUserKeyPath(&KeyPath);
  if( v4 >= 0 )
  {
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &KeyPath;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 1600;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v4 = ZwOpenKey(CurrentUserKey, v2, &ObjectAttributes);
    RtlFreeAnsiString(&KeyPath);
  }
  if( v4 == -1073741772 )
  {
    RtlInitUnicodeString(&KeyPath, L"\\Registry\\User\\.Default", v5);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &KeyPath;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 1600;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    return(unsigned int)ZwOpenKey(CurrentUserKey, v2, &ObjectAttributes);
  }
  return(unsigned int)v4;
}

Referenced by: