CmpQueryHiveRedirectionFileList

UINT8 __stdcall CmpQueryHiveRedirectionFileList(_UNICODE_STRING *HiveRootPath, _UNICODE_STRING *FilePath){
  WCHAR v2; 
  NTSTATUS v6; 
  bool v7; 
  NTSTATUS v8; 
  UINT64 CreateOptions; 
  ULONG ResultLength; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[12]; 
  __int16 Source[250]; 
  KeyHandle = 0i64;
  DestinationString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( !CmStateSeparationEnabled )
    return 0;
  ResultLength = 512;
  if( CmpHiveRedirectionFileListHandle )
    goto LABEL_7;
  RtlInitUnicodeString(
    &DestinationString,
    L"\\registry\\machine\\system\\currentcontrolset\\control\\hiveredirectionlist",
    v2);
  ObjectAttributes.RootDirectory = 0i64;
  LODWORD(CreateOptions) = 1;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 576;
  v6 = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  v7 = v6 == 0;
  if( v6 >= 0 )
  {
    if( _InterlockedCompareExchange64(
           (volatile signed __int64 *)&CmpHiveRedirectionFileListHandle,
           (signed __int64)KeyHandle,
           0i64) )
    {
      ZwClose(KeyHandle);
    }
LABEL_7:
    v8 = ZwQueryValueKey(
           CmpHiveRedirectionFileListHandle,
           HiveRootPath,
           KeyValuePartialInformation,
           KeyValueInformation,
           ResultLength,
           &ResultLength);
    v7 = v8 == 0;
    if( v8 >= 0 )
      return RtlAppendUnicodeToString(FilePath, (PWCHAR)Source) == 0;
  }
  return v7;
}

Referenced by: