CmpGetKnownHivePathNode
CHAR __fastcall CmpGetKnownHivePathNode(
INT64 a1,
UINT64 a2,
INT64 a3,
UINT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
unsigned int v8;
unsigned int v11;
char v12;
CHAR result;
__int128 a3a;
UNICODE_STRING String1;
DWORD1(a3a) = 0;
v8 = a2;
v11 = a4;
*((_QWORD *)&a3a + 1) = *(_QWORD *)(a5 + 8) + 36i64;
WORD1(a3a) = *(_WORD *)(a5 + 2) - 36;
LOWORD(a3a) = *(_WORD *)a5 - 36;
String1 = 0i64;
CmpGetNextName((_UNICODE_STRING *)&a3a, &String1, (UINT8 *)&a5);
if( !v12 )
return 0;
if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&CmpSystemHiveName, 1u) )
{
if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&CmpDevicesHiveName, 1u) )
return 0;
a1 = a3;
v8 = v11;
}
if( !a1 )
return 0;
result = CmpFindHiveSubKey(a1, v8, &a3a, (__int64 *)a7, a8);
if( result )
*(_QWORD *)a6 = a1;
return result;
}Referenced by:
CmpFindRedirectedDriverServiceStateNode