RtlOpenCurrentUser

NTSTATUS __stdcall RtlOpenCurrentUser(UINT64 DesiredAccess, VOID **CurrentUserKey){
  unsigned int v2; 
  int v4; 
  INT64 v5; 
  INT64 v7; 
  _UNICODE_STRING CurrentUserKeyPath; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  v2 = DesiredAccess;
  CurrentUserKeyPath = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v4 = RtlFormatCurrentUserKeyPath(&CurrentUserKeyPath);
  if( v4 >= 0 )
  {
    ObjectAttributes.ObjectName = &CurrentUserKeyPath;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 1600;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v4 = ZwOpenKey(
           CurrentUserKey,
           v2,
           &ObjectAttributes,
           v5,
           *(INT64 *)&CurrentUserKeyPath.Length,
           (INT64)CurrentUserKeyPath.Buffer,
           *(INT64 *)&ObjectAttributes.Length,
           0i64);
    RtlFreeAnsiString(&CurrentUserKeyPath);
  }
  if( v4 == -1073741772 )
  {
    RtlInitUnicodeString(&CurrentUserKeyPath, L"\\Registry\\User\\.Default");
    ObjectAttributes.ObjectName = &CurrentUserKeyPath;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 1600;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    return ZwOpenKey(
             CurrentUserKey,
             v2,
             &ObjectAttributes,
             v7,
             *(INT64 *)&CurrentUserKeyPath.Length,
             (INT64)CurrentUserKeyPath.Buffer,
             *(INT64 *)&ObjectAttributes.Length,
             0i64);
  }
  return v4;
}

Referenced by: