CmpFindHiveSubKey
bool __fastcall CmpFindHiveSubKey(__int64 a1, unsigned int a2, __int128 *a3, __int64 *a4, __int64 a5){
char v5;
unsigned int v10;
_UNICODE_STRING *v11;
UINT64 v12;
__int64 v14;
_UNICODE_STRING String2;
_UNICODE_STRING v16[2];
UINT8 v17;
v5 = 0;
v10 = *(_DWORD *)(*(_QWORD *)(a1 + 64) + 36i64);
String2 = 0i64;
if( a3 && *(_WORD *)a3 )
{
v16[0] = (_UNICODE_STRING)*a3;
if( !CmpGetNextName(v16, &String2, &v17) )
return v5;
if( (unsigned __int8)RtlEqualUnicodeString(&CmpCCSString, &String2, 1u) )
{
v11 = v16;
v12 = a2;
}
else
{
v11 = (_UNICODE_STRING *)a3;
v12 = v10;
}
v10 = CmpWalkUnicodeStringPath(a1, v12, v11);
}
if( v10 != -1 )
{
v14 = (*(__int64(__fastcall **)(__int64, _QWORD, __int64))(a1 + 8))(a1, v10, a5);
*a4 = v14;
return v14 != 0;
}
return v5;
}Referenced by:
CmpGetKnownHivePathNode
CmpGetStateSepKeysRedirectionPathValue