ExpWnfGetNameStoreRegistryRoot

NTSTATUS __stdcall ExpWnfGetNameStoreRegistryRoot(_WNF_STATE_NAME_LIFETIME NameLifetime, VOID **StoreRoot){
  __int64 v3; 
  VOID **p_PermanentNameStoreRootKey; 
  NTSTATUS result; 
  __int64 *v6; 
  bool v7; 
  UINT64 v8; 
  __int64 v9; 
  NTSTATUS v10; 
  UINT64 CreateOptions; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 Disposition; 
  VOID *KeyHandle; 

  LODWORD(Disposition) = 0;
  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v3 = 6i64 * (int)NameLifetime;
  if( NameLifetime )
  {
    if( NameLifetime == WnfPermanentStateName )
      p_PermanentNameStoreRootKey = (VOID **)&PsGetCurrentServerSiloGlobals(*(_KSPIN_LOCK **)&NameLifetime)->WnfSiloState.PermanentNameStoreRootKey;
    else
      p_PermanentNameStoreRootKey = (VOID **)&PsGetCurrentServerSiloGlobals(*(_KSPIN_LOCK **)&NameLifetime)->WnfSiloState.PersistentNameStoreRootKey;
  }
  else
  {
    p_PermanentNameStoreRootKey = (VOID **)&ExpWnfWellKnownNameStoreRootKey;
  }
  if( *p_PermanentNameStoreRootKey )
  {
LABEL_4:
    *StoreRoot = *p_PermanentNameStoreRootKey;
    return 0;
  }
  v6 = &ExpWnfNameStoreDescriptors[3];
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  if( !*(&stru_140CF2E80 + 1656) )
    v6 = &ExpWnfNameStoreDescriptors[1];
  v7 = HIDWORD(ExpWnfNameStoreDescriptors[v3 + 5]) == 0;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v6[v3];
  LODWORD(CreateOptions) = !v7;
  v8 = LODWORD(ExpWnfNameStoreDescriptors[v3 + 5]) != 0 ? 131097 : 983103;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwCreateKey(&KeyHandle, v8, &ObjectAttributes, 0i64, 0i64, CreateOptions, &Disposition);
  if( result >= 0 )
  {
    if( (_DWORD)Disposition == 1 )
    {
      LOBYTE(v9) = *(&stru_140CF2E80 + 1656) != 0;
      v10 = ExpInitializeStateSeparationPhase2(
              v9,
              &ExpWnfNameStoreDescriptors[v3 + 1],
              &ExpWnfNameStoreDescriptors[v3 + 3]);
      if( v10 == -1073741637 )
        v10 = 0;
      if( v10 < 0 )
      {
        ZwClose((_HANDLE)KeyHandle);
        return v10;
      }
    }
    if( _InterlockedCompareExchange64(
           (volatile signed __int64 *)p_PermanentNameStoreRootKey,
           (signed __int64)KeyHandle,
           0i64) )
    {
      ZwClose((_HANDLE)KeyHandle);
    }
    goto LABEL_4;
  }
  return result;
}

Referenced by: