RtlpInitNlsFileName

NTSTATUS __stdcall RtlpInitNlsFileName(
        UINT64 SectionType,
        UINT64 SectionData,
        PWCHAR FileName,
        UNICODE_STRING *pObFileName){
  unsigned int v5; 
  int v6; 
  NTSTATUS result; 
  WCHAR v8; 
  int v9; 
  int v10; 
  ULONG ResultLength; 
  void *KeyHandle; 
  struct _UNICODE_STRING String; 
  struct _UNICODE_STRING v14; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char v16; 
  char KeyValueInformation[4]; 
  int v18; 
  struct _UNICODE_STRING *DestinationString; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ResultLength = 0;
  v5 = SectionData;
  KeyHandle = 0i64;
  v14 = 0i64;
  v6 = SectionType - 11;
  if( v6 )
  {
    if( v6 != 1 )
      return -1073741585;
    RtlInitUnicodeString(
      &v14,
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Normalization",
      (WCHAR)FileName);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &v14;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v9 = ZwOpenKey(&KeyHandle, 0x80000000, &ObjectAttributes);
    if( v9 < 0 )
      return v9;
    *(_DWORD *)(&String.MaximumLength + 1) = 0;
    *(_DWORD *)&String.Length = 4194368;
    String.Buffer = (wchar_t *)&v16;
    RtlIntegerToUnicodeString(v5, 0x10ui64, &String);
    v9 = ZwQueryValueKey(KeyHandle, &String, KeyValuePartialInformation, KeyValueInformation, 0x120u, &ResultLength);
    ZwClose(KeyHandle);
    if( v9 < 0 )
      return v9;
    if( v18 != 1 )
      return -1073741823;
    RtlStringCchPrintfW(FileName, 0x40ui64, (WCHAR *)L"\\SystemRoot\\System32\\%s");
    v9 = v10;
    if( v10 < 0 )
      return v9;
  }
  else
  {
    RtlStringCchPrintfW(FileName, 0x40ui64, (WCHAR *)L"\\SystemRoot\\System32\\c_%.3d.nls");
    v9 = result;
    if( result < 0 )
      return result;
  }
  RtlInitUnicodeString(DestinationString, FileName, v8);
  return v9;
}

Referenced by: