RegRtlOpenKeyTransacted
NTSTATUS __stdcall RegRtlOpenKeyTransacted(
VOID *hKey,
const WCHAR *SubKey,
UINT64 RegOptions,
UINT64 DesiredAccess,
VOID **phkResult,
VOID *hTransaction){
VOID *v6;
unsigned int v7;
unsigned int v8;
void *v10;
int inited;
VOID *v12;
NTSTATUS(__stdcall *v14)(VOID **, UINT64, _OBJECT_ATTRIBUTES *, VOID *);
INT64 v15;
VOID *v16;
INT64 v17;
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
VOID *phkPredef;
v6 = 0i64;
v7 = DesiredAccess;
phkPredef = 0i64;
v8 = RegOptions;
v10 = hKey;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
DestinationString = 0i64;
if( (char *)hKey + 0x80000000 <= (char *)7 )
{
inited = RegRtlOpenPredefinedKey(
hKey,
&phkPredef,
RegOptions,
DesiredAccess,
v15,
v17,
*(INT64 *)&DestinationString.Length,
(INT64)DestinationString.Buffer);
if( inited < 0 )
goto LABEL_7;
v6 = phkPredef;
}
inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)SubKey);
if( inited < 0 )
goto LABEL_8;
ObjectAttributes.Length = 48;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( v6 )
v10 = v6;
v12 = hTransaction;
ObjectAttributes.RootDirectory = v10;
ObjectAttributes.Attributes = (v8 & 8) != 0 ? 832 : 576;
ObjectAttributes.ObjectName = &DestinationString;
if( hTransaction )
{
v16 = hTransaction;
inited = NtOpenKeyTransactedEx_Stub((INT64)phkResult);
if( inited == -1073741702 )
{
if( byte_140CF9E98 )
{
v14 = (NTSTATUS(__stdcall *)(VOID **, UINT64, _OBJECT_ATTRIBUTES *, VOID *))qword_140CF9E80;
}
else
{
v14 = ZwOpenKeyTransacted;
byte_140CF9E98 = 1;
qword_140CF9E80 = (__int64)ZwOpenKeyTransacted;
}
if( !v14
|| (inited = ((__int64(__fastcall *)(VOID **, _QWORD, _OBJECT_ATTRIBUTES *, VOID *, VOID *))v14)(
phkResult,
v7,
&ObjectAttributes,
v12,
v16),
inited == -1073741702) )
{
inited = -1072103420;
}
}
}
else
{
inited = ZwOpenKeyEx(
phkResult,
v7,
&ObjectAttributes,
v8,
v15,
v17,
*(INT64 *)&DestinationString.Length,
(INT64)DestinationString.Buffer);
}
LABEL_7:
v6 = phkPredef;
LABEL_8:
if( v6 )
ZwClose((_HANDLE)v6);
return inited;
}Referenced by:
RegRtlCopyTreeInternal
RegRtlDeleteKeyTransacted
RegRtlDeletePathInternal
RegRtlDeleteTreeInternal
RegRtlOpenPredefinedKey
SysCtxOpenControlSet
SysCtxOpenMachine
SysCtxRegOpenKey