RtlWriteRegistryValue
INT64 __fastcall RtlWriteRegistryValue(
UINT64 RelativeTo,
const WCHAR *Path,
const WCHAR *ValueName,
UINT64 ValueType,
VOID *ValueData,
UINT64 ValueLength){
int v6;
int v8;
INT64 result;
WCHAR v10;
unsigned int v11;
UINT64 DataSize;
HANDLE KeyHandle;
struct _UNICODE_STRING DestinationString;
KeyHandle = 0i64;
v6 = ValueType;
DestinationString = 0i64;
v8 = RelativeTo;
result = RtlpGetRegistryHandle(RelativeTo, Path, 1u, &KeyHandle);
if( (int)result >= 0 )
{
RtlInitUnicodeString(&DestinationString, ValueName, v10);
LODWORD(DataSize) = ValueLength;
v11 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, v6 & 0xFFFFFF, ValueData, DataSize);
if( (v8 & 0x40000000) == 0 )
ZwClose(KeyHandle);
return v11;
}
return result;
}Referenced by:
EtwStartAutoLogger
EtwpEnableAutoLoggerProvider
EtwpEnumerateAutologgerPath
EtwpEnumerateKeyProviders
ExpWriteSiloTimeZoneMarker
KseKPSOHookDriverTargeted
PerfDiagpSaveActiveDCLLogFileName
RtlSetActiveTimeBias
RtlSetPortableOperatingSystem
RtlpSetTimeZoneInformationWorker
RtlpUpdateDynamicTimeZones
WheapCommitPolicy
WmipSaveGuidSecurityDescriptor