BapdpWriteEventDataToRegistry

VOID __fastcall BapdpWriteEventDataToRegistry(VOID *Data, UINT64 DataSize, _UNICODE_STRING *Name){
  WCHAR v5; 
  NTSTATUS v6; 
  UINT64 DataSizea; 
  UINT64 DataSizeb; 
  HANDLE Handle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *KeyHandle; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  Handle = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control", (WCHAR)Name);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x2001Fu, &ObjectAttributes) >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Session Manager\\Power", v5);
    LODWORD(DataSizea) = 0;
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v6 = ZwCreateKey(&Handle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, DataSizea, 0i64);
    ZwClose(KeyHandle);
    if( v6 >= 0 )
    {
      LODWORD(DataSizeb) = 4;
      ZwSetValueKey(Handle, Name, 0i64, 4ui64, Data, DataSizeb);
      ZwClose(Handle);
    }
  }
}

Referenced by: