CreateMiniNtBootKey

VOID __stdcall CreateMiniNtBootKey(){
  NTSTATUS v0; 
  VOID **PoolWithTag; 
  VOID **v2; 
  INT64 v3; 
  _ETHREAD *CurrentThread; 
  _UNICODE_STRING *Class; 
  INT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 *Disposition; 
  INT64 v9; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _FAST_MUTEX FastMutex; 
  UINT64 v13; 
  VOID *KeyHandle; 
  VOID *Handle; 

  LODWORD(v13) = 0;
  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v0 = 0;
  DestinationString = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x200ui64, 1953066569i64);
  v2 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_9;
  swprintf_s((WCHAR *)PoolWithTag, 0x100ui64, (WCHAR *)L"%s\\Control", CmRegistryMachineSystemCurrentControlSet.Buffer);
  *((_WORD *)v2 + 255) = 0;
  RtlInitUnicodeString(&DestinationString, (PCWSTR)v2);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v0 = ZwOpenKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, v3, (INT64)Class, CreateOptions, (INT64)Disposition, v9);
  if( v0 < 0 )
    goto LABEL_9;
  Handle = 0i64;
  RtlInitUnicodeString(&DestinationString, L"MiniNT");
  ObjectAttributes.RootDirectory = KeyHandle;
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Attributes = 64;
  LODWORD(CreateOptionsa) = 1;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v0 = ZwCreateKey(&Handle, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsa, &v13);
  if( v0 >= 0 )
    ZwClose((_HANDLE)Handle);
  ZwClose((_HANDLE)KeyHandle);
  if( v0 < 0 )
LABEL_9:
    KeBugCheckEx(0x32u, (PVOID)v0, (PVOID)6, 0i64, 0i64);
  ExFreePoolWithTag(v2, 0);
  if( InitForceInline == 1 )
  {
    memset(&FastMutex, 0, sizeof(FastMutex));
    ExTryToAcquireFastMutex(&FastMutex);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.SpecialApcDisable;
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    KeGetCurrentIrql();
    __writecr8(2ui64);
  }
}

Referenced by: