CmpUpdateReorganizeRegistryValues

VOID __stdcall CmpUpdateReorganizeRegistryValues(){
  WCHAR v0; 
  WCHAR v1; 
  __int64 v2; 
  WCHAR v3; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  union _LARGE_INTEGER LocalTime; 
  struct _TIME_FIELDS TimeFields; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 Dst[16]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  KeyHandle = 0i64;
  TimeFields = 0i64;
  LocalTime.QuadPart = 0i64;
  if( *(_QWORD *)CmpReorganizeTotalBytesSaved )
  {
    if( CmpAccessBitForPhase == 2 )
    {
      RtlInitUnicodeString(
        &DestinationString,
        L"\\registry\\machine\\system\\CurrentControlSet\\Control\\Session Manager\\Configuration Manager\\Defrag",
        v0);
      LODWORD(CreateOptions) = 0;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 704;
      ObjectAttributes.ObjectName = &DestinationString;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      if( ZwCreateKey(&KeyHandle, 2ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64) >= 0 )
      {
        ExSystemTimeToLocalTime(&CmpReorganizeLastRun, &LocalTime);
        RtlTimeToTimeFields(&LocalTime, &TimeFields);
        v2 = -1i64;
        if( (unsigned int)swprintf_s((WCHAR *)Dst, 0x10ui64, (WCHAR *)L"%02d:%02d:%04d") != -1 )
        {
          RtlInitUnicodeString(&DestinationString, L"LastRun", v1);
          do
            ++v2;
          while( Dst[v2] );
          LODWORD(CreateOptionsa) = 2 * v2;
          if( ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 1ui64, Dst, CreateOptionsa) >= 0 )
          {
            RtlInitUnicodeString(&DestinationString, L"TotalBytesSaved", v3);
            LODWORD(CreateOptionsb) = 8;
            ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 0xBui64, CmpReorganizeTotalBytesSaved, CreateOptionsb);
          }
        }
        ZwClose(KeyHandle);
      }
    }
  }
}

Referenced by: