RtlFormatCurrentUserKeyPath
INT64 __fastcall RtlFormatCurrentUserKeyPath(_UNICODE_STRING *CurrentUserKeyPath){
INT64 result;
unsigned __int16 v3;
UINT64 v4;
wchar_t *StringRoutine;
wchar_t *Buffer;
unsigned __int64 v7;
NTSTATUS v8;
UINT64 StringLength;
struct _UNICODE_STRING UnicodeString;
VOID *TokenInformation;
StringLength = 0i64;
*(_DWORD *)(&UnicodeString.MaximumLength + 1) = 0;
LODWORD(result) = ZwQueryInformationToken(
(HANDLE)0xFFFFFFFFFFFFFFFAi64,
TokenUser,
&TokenInformation,
0x58u,
(PULONG)&StringLength + 1);
if( (int)result >= 0 )
{
result = RtlLengthSidAsUnicodeString(TokenInformation, &StringLength);
if( (int)result >= 0 )
{
v3 = StringLength;
CurrentUserKeyPath->Length = 0;
v4 = (unsigned __int16)(v3 + 34);
CurrentUserKeyPath->MaximumLength = v4;
StringRoutine = (wchar_t *)ExpAllocateStringRoutine(v4);
CurrentUserKeyPath->Buffer = StringRoutine;
if( StringRoutine )
{
RtlAppendUnicodeToString(CurrentUserKeyPath, (PWCHAR)L"\\REGISTRY\\USER\\");
Buffer = CurrentUserKeyPath->Buffer;
v7 = (unsigned __int64)CurrentUserKeyPath->Length >> 1;
UnicodeString.MaximumLength = v3;
UnicodeString.Length = 0;
UnicodeString.Buffer = &Buffer[v7];
v8 = RtlConvertSidToUnicodeString(&UnicodeString, TokenInformation, 0);
if( v8 < 0 )
RtlFreeAnsiString(CurrentUserKeyPath);
else
CurrentUserKeyPath->Length += UnicodeString.Length;
return(unsigned int)v8;
}
else
{
return 3221225495i64;
}
}
}
return result;
}Referenced by:
AslRegistryBuildUserPath
RegRtlOpenPredefinedKey
RtlOpenCurrentUser
RtlpGetRegistryHandle