PiLastGoodRevertLastKnownDirectory

VOID __fastcall PiLastGoodRevertLastKnownDirectory(
        _UNICODE_STRING *LastKnownGoodDirectory,
        _UNICODE_STRING *LastKnownGoodRegPath){
  void *v4; 
  unsigned __int16 *PoolWithTag; 
  unsigned int v6; 
  UINT64 i; 
  unsigned int v8; 
  char *v9; 
  __int64 v10; 
  UINT64 Length; 
  UINT64 ResultLength; 
  void *KeyHandle; 
  struct _UNICODE_STRING Destination; 
  UNICODE_STRING Source; 
  OBJECT_ATTRIBUTES v16; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  INT64 result[3]; 
  char v19; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  Destination = 0i64;
  Source = 0i64;
  memset(&v16, 0, sizeof(v16));
  memset((INT64)result, 0i64);
  LODWORD(ResultLength) = 0;
  PoolWithTag = (unsigned __int16 *)ExAllocatePoolWithTag(PagedPool, 0x21Cui64, 0x674C7050ui64);
  if( PoolWithTag )
  {
    IopFileUtilWalkDirectoryTreeTopDown(LastKnownGoodDirectory, v4);
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = LastKnownGoodRegPath;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(&KeyHandle, 0xF003Fu, &ObjectAttributes) >= 0 )
    {
      v6 = 1;
      for( i = 0i64; ; i = v6++ )
      {
        LODWORD(Length) = 540;
        if( ZwEnumerateValueKey(KeyHandle, i, KeyValueFullInformation, PoolWithTag, Length, &ResultLength) < 0 )
          break;
        if( (_DWORD)ResultLength
          && *((_DWORD *)PoolWithTag + 1) == 4
          && *((_DWORD *)PoolWithTag + 3) == 4
          && (unsigned __int8)*(_DWORD *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2)) == 1 )
        {
          *(_DWORD *)&Destination.Length = 35127296;
          Destination.Buffer = (wchar_t *)result;
          Source.Buffer = PoolWithTag + 10;
          Source.Length = PoolWithTag[8];
          Source.MaximumLength = Source.Length;
          RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\\SystemRoot\\");
          RtlAppendUnicodeStringToString(&Destination, &Source);
          v8 = Destination.Length >> 1;
          if( v8 > 0xD )
          {
            v9 = &v19;
            v10 = v8 - 13;
            do
            {
              if( *(_WORD *)v9 == 47 )
                *(_WORD *)v9 = 92;
              v9 += 2;
              --v10;
            }
            while( v10 );
          }
          IopFileUtilClearAttributes(&Destination);
          v16.Length = 48;
          v16.ObjectName = &Destination;
          v16.RootDirectory = 0i64;
          *(_OWORD *)&v16.SecurityDescriptor = 0i64;
          v16.Attributes = 576;
          ZwDeleteFile(&v16);
        }
      }
      ZwDeleteKey(KeyHandle);
      ZwClose(KeyHandle);
    }
    ExFreePoolWithTag(PoolWithTag, 0x674C7050u);
  }
}

Referenced by: