RtlFormatCurrentUserKeyPath

INT64 __fastcall RtlFormatCurrentUserKeyPath(_UNICODE_STRING *CurrentUserKeyPath){
  INT64 result; 
  unsigned __int16 v3; 
  UINT64 v4; 
  wchar_t *StringRoutine; 
  wchar_t *Buffer; 
  unsigned __int64 v7; 
  NTSTATUS v8; 
  UINT64 StringLength; 
  struct _UNICODE_STRING UnicodeString; 
  VOID *TokenInformation; 
  StringLength = 0i64;
  *(_DWORD *)(&UnicodeString.MaximumLength + 1) = 0;
  LODWORD(result) = ZwQueryInformationToken(
                      (HANDLE)0xFFFFFFFFFFFFFFFAi64,
                      TokenUser,
                      &TokenInformation,
                      0x58u,
                      (PULONG)&StringLength + 1);
  if( (int)result >= 0 )
  {
    result = RtlLengthSidAsUnicodeString(TokenInformation, &StringLength);
    if( (int)result >= 0 )
    {
      v3 = StringLength;
      CurrentUserKeyPath->Length = 0;
      v4 = (unsigned __int16)(v3 + 34);
      CurrentUserKeyPath->MaximumLength = v4;
      StringRoutine = (wchar_t *)ExpAllocateStringRoutine(v4);
      CurrentUserKeyPath->Buffer = StringRoutine;
      if( StringRoutine )
      {
        RtlAppendUnicodeToString(CurrentUserKeyPath, (PWCHAR)L"\\REGISTRY\\USER\\");
        Buffer = CurrentUserKeyPath->Buffer;
        v7 = (unsigned __int64)CurrentUserKeyPath->Length >> 1;
        UnicodeString.MaximumLength = v3;
        UnicodeString.Length = 0;
        UnicodeString.Buffer = &Buffer[v7];
        v8 = RtlConvertSidToUnicodeString(&UnicodeString, TokenInformation, 0);
        if( v8 < 0 )
          RtlFreeAnsiString(CurrentUserKeyPath);
        else
          CurrentUserKeyPath->Length += UnicodeString.Length;
        return(unsigned int)v8;
      }
      else
      {
        return 3221225495i64;
      }
    }
  }
  return result;
}

Referenced by:

AslRegistryBuildUserPath
RegRtlOpenPredefinedKey
RtlOpenCurrentUser
RtlpGetRegistryHandle