CmpQueryHiveRedirectionFileList

bool __fastcall CmpQueryHiveRedirectionFileList(_UNICODE_STRING *ValueName, _UNICODE_STRING *Destination, WCHAR a3){
  NTSTATUS v6; 
  bool v7; 
  NTSTATUS v8; 
  UINT64 Length; 
  UINT64 CreateOptions; 
  UINT64 ResultLength; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[12]; 
  __int16 Source[250]; 

  KeyHandle = 0i64;
  DestinationString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( !*(&stru_140CF2E80 + 1656) )
    return 0;
  LODWORD(ResultLength) = 512;
  if( CmpHiveRedirectionFileListHandle )
    goto LABEL_7;
  RtlInitUnicodeString(
    &DestinationString,
    L"\\registry\\machine\\system\\currentcontrolset\\control\\hiveredirectionlist");
  ObjectAttributes.RootDirectory = 0i64;
  LODWORD(CreateOptions) = 1;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 576;
  v6 = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  v7 = v6 == 0;
  if( v6 >= 0 )
  {
    if( _InterlockedCompareExchange64(
           (volatile signed __int64 *)&CmpHiveRedirectionFileListHandle,
           (signed __int64)KeyHandle,
           0i64) )
    {
      ZwClose((_HANDLE)KeyHandle);
    }
LABEL_7:
    LODWORD(Length) = ResultLength;
    v8 = ZwQueryValueKey(
           CmpHiveRedirectionFileListHandle,
           ValueName,
           KeyValuePartialInformation,
           KeyValueInformation,
           Length,
           &ResultLength);
    v7 = v8 == 0;
    if( v8 >= 0 )
      return RtlAppendUnicodeToString(Destination, (WCHAR *)Source) == 0;
  }
  return v7;
}

Referenced by: