InitSafeBoot

VOID __stdcall InitSafeBoot(UINT8 UseAlternateShell){
  INT64 v1; 
  NTSTATUS v3; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  UINT64 *ResultLengthb; 
  UINT64 *ResultLengthc; 
  UINT64 *Disposition; 
  INT64 v11; 
  int Data; 
  VOID *KeyHandle; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  UINT64 v16; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation[2]; 
  __int64 v19; 
  int v20; 

  Data = 0;
  KeyHandle = 0i64;
  v19 = 0i64;
  v20 = 0;
  Handle = 0i64;
  ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSetControlSafeBoot;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  DestinationString = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 64i64;
  memset(KeyValueInformation, 0, sizeof(KeyValueInformation));
  v16 = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, v1, Length, (INT64)ResultLength, (INT64)Disposition, v11) >= 0 )
  {
    if( UseAlternateShell )
    {
      RtlInitUnicodeString(&DestinationString, L"AlternateShell");
      LODWORD(Lengtha) = 44;
      if( NtQueryValueKey(
             KeyHandle,
             &DestinationString,
             KeyValuePartialInformation,
             KeyValueInformation,
             Lengtha,
             &v16) < 0 )
        UseAlternateShell = 0;
    }
    RtlInitUnicodeString(&DestinationString, L"Option");
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 64;
    LODWORD(ResultLengtha) = 1;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v3 = ZwCreateKey(
           &Handle,
           0xF003Fui64,
           &ObjectAttributes,
           0i64,
           0i64,
           (UINT64)ResultLengtha,
           (UINT64 *)((char *)&v16 + 4));
    NtClose((UINT64)KeyHandle);
    if( v3 >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, L"OptionValue");
      LODWORD(ResultLengthb) = 4;
      NtSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &InitSafeBootMode, (UINT64)ResultLengthb);
      if( UseAlternateShell == 1 )
      {
        RtlInitUnicodeString(&DestinationString, L"UseAlternateShell");
        LODWORD(ResultLengthc) = 4;
        Data = 1;
        NtSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, (UINT64)ResultLengthc);
      }
      NtClose((UINT64)Handle);
    }
  }
}

Referenced by: