PopOpenKey

NTSTATUS __stdcall PopOpenKey(VOID **Handle, WCHAR *Name, UINT64 AccessMask){
  INT64 v3; 
  unsigned int v4; 
  int v7; 
  INT64 v9; 
  INT64 v10; 
  UINT64 v11; 
  INT64 v12; 
  INT64 v13; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *v17; 

  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  KeyHandle = 0i64;
  v4 = AccessMask;
  v17 = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSet;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  DestinationString = 0i64;
  v7 = ZwOpenKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, v3, v9, v10, v12, v13);
  if( v7 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, Name);
    LODWORD(v11) = 0;
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = ZwCreateKey(&v17, v4, &ObjectAttributes, 0i64, 0i64, v11, 0i64);
    if( v7 < 0 )
      v17 = 0i64;
    else
      *Handle = v17;
    if( KeyHandle )
      ZwClose((_HANDLE)KeyHandle);
  }
  return v7;
}

Referenced by: