PopCheckShutdownMarker

VOID __stdcall PopCheckShutdownMarker(_LOADER_PARAMETER_BLOCK *LoaderBlock, PVOID BootStatHandle){
  char v3; 
  char v4; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  _POP_SLEEP_CHECKPOINT SleepCheckpoint; 
  UINT64 BootAppFailureStatus; 
  unsigned __int8 Value; 
  char v10; 
  bool v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  int v17[2]; 
  UINT64 ValueLength[2]; 
  struct _EVENT_DATA_DESCRIPTOR v19; 
  __int128 *v20; 
  __int64 v21; 
  int *v22; 
  __int64 v23; 
  int *v24; 
  __int64 v25; 
  __int128 *v26; 
  __int64 v27; 
  int *v28; 
  __int64 v29; 
  int *v30; 
  __int64 v31; 
  int *v32; 
  __int64 v33; 
  int *v34; 
  __int64 v35; 
  char *v36; 
  __int64 v37; 
  bool *v38; 
  __int64 v39; 
  INT64 a1[2]; 
  int v41; 
  int v42; 
  INT64 *v43; 
  int v44; 
  int v45; 
  INT64 *v46; 
  int v47; 
  LODWORD(a1[0]) = 14;
  a1[1] = (INT64)&PopBsdPhysicalPowerButtonInfo;
  Value = 0;
  v43 = &PopBsdPowerTransition;
  v41 = 48;
  v46 = &PopBsdPowerTransitionExtension;
  v42 = 7;
  v44 = 32;
  v45 = 16;
  v47 = 32;
  RtlGetSystemBootStatusEx((INT64)a1, 3ui64, 0i64);
  v3 = *(_BYTE *)(*((_QWORD *)LoaderBlock + 30) + 132i64) & 1;
  PopBsdPhysicalPowerButtonInfoAtBoot = *(_OWORD *)&PopBsdPhysicalPowerButtonInfo;
  PopLastBootSucceeded = v3;
  xmmword_140C54050 = xmmword_140C502A8;
  xmmword_140C54060 = xmmword_140C502B8;
  if( _mm_srli_si128(*(__m128i *)&PopBsdPhysicalPowerButtonInfo, 8).m128i_u32[0]
    && (unsigned int)dword_140C021E8 > 5
    && tlgKeywordOn((__int64)&dword_140C021E8, 0x200000000000i64) )
  {
    v20 = &PopBsdPhysicalPowerButtonInfoAtBoot;
    v13 = v5;
    v12 = WORD2(v5);
    v22 = &v12;
    v24 = &v13;
    v26 = &xmmword_140C54050;
    v14 = WORD6(xmmword_140C54050);
    v28 = &v14;
    v30 = &v15;
    v32 = &v16;
    v17[0] = BYTE6(v5);
    v34 = v17;
    v15 = v5;
    v6 = HIBYTE(v5);
    v10 = v6 & 1;
    v16 = HIWORD(*((_QWORD *)&xmmword_140C54050 + 1));
    v36 = &v10;
    v11 = (v6 & 2) != 0;
    v38 = &v11;
    v21 = 8i64;
    v23 = 4i64;
    v25 = 4i64;
    v27 = 8i64;
    v29 = 4i64;
    v31 = 4i64;
    v33 = 4i64;
    v35 = 4i64;
    v37 = 1i64;
    v39 = 1i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C021E8,
      (unsigned __int8 *)&byte_140025E97,
      0i64,
      0i64,
      0xCu,
      &v19);
  }
  PopBsdPowerTransitionExtensionAtBoot = *(_OWORD *)&PopBsdPowerTransitionExtension;
  xmmword_140C540A0 = xmmword_140C50498;
  *(_OWORD *)&PopBsdPowerTransitionAtBoot = *(_OWORD *)&PopBsdPowerTransition;
  xmmword_140C54080 = *(_OWORD *)Buffer;
  if( (qword_140C19658 & 4) != 0 )
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) &= ~1u;
  if( (*(_WORD *)PopSimulate & 0x200) != 0 )
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) |= 1u;
  v4 = *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) & 0xDF;
  *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) &= ~0x20u;
  if( DWORD2(PopBsdPhysicalPowerButtonInfoAtBoot) && (HIBYTE(PopBsdPhysicalPowerButtonInfoAtBoot) & 4) != 0 )
  {
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) = v4 | 0x20;
    PopBsdPowerTransitionAtBoot = PopBsdPhysicalPowerButtonInfoAtBoot;
  }
  LODWORD(BootAppFailureStatus) = 0;
  PopAutoChkCausedReboot = (*((_BYTE *)&PopBsdPowerTransition + 14) & 0x10) != 0;
  ValueLength[1] = WNF_PO_PREVIOUS_SHUTDOWN_STATE;
  v17[1] = *(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 1;
  ZwUpdateWnfStateData();
  if( (*(_WORD *)PopSimulate & 0x400) != 0 )
  {
    *((_WORD *)&PopBsdPowerTransitionAtBoot + 6) = 1;
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) = *(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 0xF | 0x50;
  }
  if( (*(_DWORD *)PopSimulate & 0x20000000) != 0 )
  {
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) |= 2u;
    *((_QWORD *)&xmmword_140C540A0 + 1) = 1i64;
  }
  if( (*(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 1) != 0 )
  {
    LODWORD(ValueLength[0]) = 1;
    if( (int)ExGetFirmwareEnvironmentVariable(
                (_UNICODE_STRING *)&PopCheckpointSystemSleepVariable,
                (_GUID *)&SYSTEM_SLEEP_ETW_CHECKPOINT_GUID,
                &Value,
                ValueLength,
                0i64) < 0 )
    {
      SleepCheckpoint = BYTE2(PopBsdPowerTransitionExtensionAtBoot);
      BYTE1(PopBsdPowerTransitionExtensionAtBoot) = BYTE1(PopBsdPowerTransitionExtensionAtBoot) & 0xF3 | 8;
      PopRecordSleepCheckpointSource(2);
    }
    else
    {
      SleepCheckpoint = Value;
      BYTE2(PopBsdPowerTransitionExtensionAtBoot) = Value;
      BYTE1(PopBsdPowerTransitionExtensionAtBoot) = BYTE1(PopBsdPowerTransitionExtensionAtBoot) & 0xF3 | 4;
      PopRecordSleepCheckpoint(Value);
      PopRecordSleepCheckpointSource(1);
      PopClearSystemSleepCheckpoint();
    }
    PopDiagTraceDirtyTransition(
      LoaderBlock,
      (_SYSTEM_POWER_STATE)(*((unsigned __int8 *)&PopBsdPowerTransitionAtBoot + 8) >> 4),
      *((unsigned __int16 *)&PopBsdPowerTransitionAtBoot + 6),
      (*(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 2) != 0,
      BYTE8(xmmword_140C50498),
      PopBsdPowerTransitionAtBoot,
      BootAppFailureStatus,
      SleepCheckpoint);
  }
}

Referenced by: