KsepRegistryCreateKey

VOID __fastcall KsepRegistryCreateKey(WCHAR *EnginePath, WCHAR *SearchKey, INT64 a3, INT64 a4){
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  _UNICODE_STRING TargetString; 
  _UNICODE_STRING String; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 
  VOID *v16; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  *(_QWORD *)&TargetString.Length = 0i64;
  TargetString.Buffer = 0i64;
  *(_QWORD *)&String.Length = 0i64;
  String.Buffer = 0i64;
  KeyHandle = 0i64;
  v16 = 0i64;
  if( !EnginePath )
  {
    v7 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v7 + 1] = -1073740768;
    KsepHistoryErrors[2 * v7] = 262647;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("EnginePath != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 503i64, 0i64);
  }
  if( !SearchKey )
  {
    v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v8 + 1] = -1073740768;
    KsepHistoryErrors[2 * v8] = 262648;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("SearchKey != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 504i64, 0i64);
  }
  if( !a3 )
  {
    v9 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v9 + 1] = -1073740768;
    KsepHistoryErrors[2 * v9] = 262649;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("Handle != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 505i64, 0i64);
  }
  KsepStringDuplicate(&TargetString, EnginePath);
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = &TargetString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64) >= 0
    && KsepStringDuplicate(&String, SearchKey) >= 0 )
  {
    ObjectAttributes.RootDirectory = KeyHandle;
    LODWORD(CreateOptionsa) = 0;
    ObjectAttributes.ObjectName = &String;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwCreateKey(&v16, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsa, 0i64) >= 0 )
    {
      *(_QWORD *)a3 = v16;
      _InterlockedIncrement(&dword_140C2A7F8);
    }
  }
  KsepStringFree(&TargetString);
  KsepStringFree(&String);
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
}

Referenced by: