CmpGetKnownHivePathNode
CHAR __fastcall CmpGetKnownHivePathNode(
INT64 a1,
UINT64 a2,
INT64 a3,
UINT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
unsigned int v8;
unsigned int v11;
CHAR result;
_UNICODE_STRING v13;
_UNICODE_STRING String1;
*(_DWORD *)(&v13.MaximumLength + 1) = 0;
v8 = a2;
v11 = a4;
v13.Buffer = (wchar_t *)(*(_QWORD *)(a5 + 8) + 36i64);
v13.MaximumLength = *(_WORD *)(a5 + 2) - 36;
v13.Length = *(_WORD *)a5 - 36;
String1 = 0i64;
if( !CmpGetNextName(&v13, &String1, (UINT8 *)&a5) )
return 0;
if( !(unsigned __int8)RtlEqualUnicodeString(&String1, &CmpSystemHiveName, 1u) )
{
if( !(unsigned __int8)RtlEqualUnicodeString(&String1, &CmpDevicesHiveName, 1u) )
return 0;
a1 = a3;
v8 = v11;
}
if( !a1 )
return 0;
result = CmpFindHiveSubKey(a1, v8, (__int128 *)&v13, (__int64 *)a7, a8);
if( result )
*(_QWORD *)a6 = a1;
return result;
}Referenced by:
CmpFindRedirectedDriverServiceStateNode