RtlpInitNlsFileName

NTSTATUS __stdcall RtlpInitNlsFileName(
        UINT64 SectionType,
        UINT64 SectionData,
        WCHAR *FileName,
        _UNICODE_STRING *pObFileName,
        _UNICODE_STRING *DestinationString){
  unsigned int v6; 
  int v7; 
  NTSTATUS result; 
  int v9; 
  INT64 v10; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v14; 
  VOID *KeyHandle; 
  _UNICODE_STRING String; 
  _UNICODE_STRING v17; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char v19; 
  char KeyValueInformation[4]; 
  int v21; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LODWORD(v14) = 0;
  v6 = SectionData;
  KeyHandle = 0i64;
  v17 = 0i64;
  v7 = SectionType - 11;
  if( v7 )
  {
    if( v7 != 1 )
      return -1073741585;
    RtlInitUnicodeString(&v17, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Normalization");
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &v17;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v9 = ZwOpenKey(
           &KeyHandle,
           0x80000000ui64,
           &ObjectAttributes,
           v10,
           Length,
           (INT64)ResultLength,
           v14,
           (INT64)KeyHandle);
    if( v9 < 0 )
      return v9;
    *(_DWORD *)(&String.MaximumLength + 1) = 0;
    *(_DWORD *)&String.Length = 4194368;
    String.Buffer = (wchar_t *)&v19;
    RtlIntegerToUnicodeString(v6, 0x10ui64, &String);
    LODWORD(Lengtha) = 288;
    v9 = ZwQueryValueKey(KeyHandle, &String, KeyValuePartialInformation, KeyValueInformation, Lengtha, &v14);
    ZwClose((_HANDLE)KeyHandle);
    if( v9 < 0 )
      return v9;
    if( v21 != 1 )
      return -1073741823;
    v9 = RtlStringCchPrintfW(FileName, 0x40ui64, (WCHAR *)L"\\SystemRoot\\System32\\%s");
    if( v9 < 0 )
      return v9;
  }
  else
  {
    result = RtlStringCchPrintfW(FileName, 0x40ui64, (WCHAR *)L"\\SystemRoot\\System32\\c_%.3d.nls");
    v9 = result;
    if( result < 0 )
      return result;
  }
  RtlInitUnicodeString(DestinationString, FileName);
  return v9;
}

Referenced by: