BiDoesHiveExist
bool __fastcall BiDoesHiveExist(__int64 a1, __int64 a2, WCHAR a3){
struct _UNICODE_STRING DestinationString;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
struct _FILE_BASIC_INFORMATION FileInformation;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
memset(&FileInformation, 0, sizeof(FileInformation));
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, (PCWSTR)(a1 + 12), a3);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
return ZwQueryAttributesFile(&ObjectAttributes, &FileInformation) >= 0 && (FileInformation.FileAttributes & 0x10) == 0;
}Referenced by:
BiLoadHive