MmZeroPageFileAtShutdown

VOID __fastcall MmZeroPageFileAtShutdown(){
  int v0; 
  ULONG ResultLength; 
  void *KeyHandle; 
  __int64 v3[2]; 
  struct _UNICODE_STRING ValueName; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v7; 
  KeyHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  ResultLength = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  v7 = 0;
  v0 = 0;
  ObjectAttributes.RootDirectory = 0i64;
  v3[1] = (__int64)L"\\registry\\machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management";
  ObjectAttributes.Length = 48;
  ValueName.Buffer = L"ClearPageFileAtShutdown";
  v3[0] = 11141288i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v3;
  KeyValueInformation = 0i64;
  *(_QWORD *)&ValueName.Length = 3145774i64;
  ObjectAttributes.Attributes = 576;
  if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
  {
    if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, 0x14u, &ResultLength) >= 0
      && DWORD1(KeyValueInformation) == 4 )
    {
      v0 = HIDWORD(KeyValueInformation);
    }
    ObCloseHandle(KeyHandle, 0);
    if( v0 )
      byte_140C4E402 = 1;
  }
}

Referenced by: