CmpLinkKeyToHive

UINT8 __stdcall CmpLinkKeyToHive(WCHAR *KeyPath, WCHAR *HivePath){
  WCHAR v2; 
  WCHAR v4; 
  NTSTATUS v5; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  struct _UNICODE_STRING Data; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 Disposition; 
  void *KeyHandle; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  LODWORD(Disposition) = 0;
  DestinationString = 0i64;
  Data = 0i64;
  RtlInitUnicodeString(&DestinationString, KeyPath, v2);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  LODWORD(CreateOptions) = 3;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwCreateKey(&KeyHandle, 0x20ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, &Disposition) >= 0 )
  {
    if( (_DWORD)Disposition == 1 )
    {
      RtlInitUnicodeString(&Data, HivePath, v4);
      LODWORD(CreateOptionsa) = Data.Length;
      v5 = ZwSetValueKey(KeyHandle, &CmSymbolicLinkValueName, 0i64, 6ui64, Data.Buffer, CreateOptionsa);
      ZwClose(KeyHandle);
      if( v5 >= 0 )
        return 1;
    }
    else
    {
      ZwClose(KeyHandle);
    }
  }
  return 0;
}

Referenced by: