CmpInitBackupHive

NTSTATUS __fastcall CmpInitBackupHive(__int64 a1, const WCHAR *a2, WCHAR a3){
  WCHAR v5; 
  UINT64 FileAttributes; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  struct _STRING Destination; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  char v16; 
  *(_QWORD *)&Destination.Length = 0x800000i64;
  Destination.Buffer = &v16;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  IoStatusBlock = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\SystemRoot\\System32\\Config\\RegBack\\", a3);
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  RtlInitUnicodeString(&DestinationString, a2, v5);
  RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString);
  LODWORD(EaLength) = 0;
  LODWORD(CreateOptions) = 51208;
  LODWORD(CreateDisposition) = 3;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&Destination;
  LODWORD(ShareAccess) = 0;
  LODWORD(FileAttributes) = 128;
  ObjectAttributes.SecurityDescriptor = CmpAdminSystemFileSecurityDescriptor;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  return ZwCreateFile(
           (PVOID *)(a1 + 1560),
           0x10003ui64,
           &ObjectAttributes,
           &IoStatusBlock,
           0i64,
           FileAttributes,
           ShareAccess,
           CreateDisposition,
           CreateOptions,
           0i64,
           EaLength);
}

Referenced by: