NtEnableLastKnownGood

INT64 __fastcall NtEnableLastKnownGood(){
  int CachedContextBaseKey; 
  char v1; 
  WCHAR v2; 
  WCHAR v3; 
  WCHAR v4; 
  WCHAR v5; 
  struct _UNICODE_STRING ValueName; 
  OBJECT_ATTRIBUTES v8; 
  PVOID P; 
  UNICODE_STRING SourceString; 
  UNICODE_STRING Directory; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING v13; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *KeyHandle; 
  HANDLE Handle; 
  HANDLE v17; 
  void *v18; 
  KeyHandle = 0i64;
  Handle = 0i64;
  v17 = 0i64;
  v18 = 0i64;
  P = 0i64;
  DestinationString = 0i64;
  SourceString = 0i64;
  v13 = 0i64;
  Directory = 0i64;
  memset(&v8, 0, sizeof(v8));
  ValueName = 0i64;
  if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
  {
    if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, 1) )
    {
      CachedContextBaseKey = PnpCtxGetCachedContextBaseKey(PiPnpRtlCtx, 4, (__int64 *)&v18);
      if( CachedContextBaseKey >= 0 )
      {
        *(&ObjectAttributes.Length + 1) = 0;
        memset(&ObjectAttributes.Attributes + 1, 0, 20);
        ValueName.Buffer = (wchar_t *)L"Control\\Pnp";
        ObjectAttributes.RootDirectory = v18;
        *(_DWORD *)&ValueName.Length = 1572886;
        ObjectAttributes.ObjectName = &ValueName;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        CachedContextBaseKey = ZwOpenKey(&KeyHandle, 0xF003Fu, &ObjectAttributes);
        if( CachedContextBaseKey >= 0 )
        {
          v1 = 0;
          if( IopGetRegistryValue(KeyHandle, (PWCHAR)L"DisableLKG", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) < 0 )
            goto LABEL_25;
          if( *((_DWORD *)P + 1) == 4 && *((_DWORD *)P + 3) == 4 )
            v1 = *((_BYTE *)P + *((unsigned int *)P + 2));
          ExFreePoolWithTag(P, 0);
          if( v1 )
          {
            *(_DWORD *)&ValueName.Length = 1441812;
            ValueName.Buffer = (wchar_t *)L"DisableLKG";
            CachedContextBaseKey = ZwDeleteValueKey(KeyHandle, &ValueName);
            if( CachedContextBaseKey >= 0 )
            {
              RtlInitUnicodeString(
                &DestinationString,
                L"\\Registry\\Machine\\System\\LastKnownGoodRecovery\\LastGood",
                v2);
              v8.RootDirectory = 0i64;
              v8.ObjectName = &DestinationString;
              v8.Length = 48;
              v8.Attributes = 576;
              *(_OWORD *)&v8.SecurityDescriptor = 0i64;
              if( ZwOpenKey(&Handle, 0xF003Fu, &v8) >= 0 )
                ZwDeleteKey(Handle);
              RtlInitUnicodeString(&v13, L"\\Registry\\Machine\\System\\LastKnownGoodRecovery\\LastGood.Tmp", v3);
              v8.RootDirectory = 0i64;
              v8.ObjectName = &v13;
              v8.Length = 48;
              v8.Attributes = 576;
              *(_OWORD *)&v8.SecurityDescriptor = 0i64;
              if( ZwOpenKey(&v17, 0xF003Fu, &v8) >= 0 )
                ZwDeleteKey(v17);
              RtlInitUnicodeString(&SourceString, L"\\SystemRoot\\LastGood", v4);
              IopFileUtilWalkDirectoryTreeBottomUp(&SourceString);
              v8.RootDirectory = 0i64;
              v8.ObjectName = &SourceString;
              v8.Length = 48;
              v8.Attributes = 64;
              *(_OWORD *)&v8.SecurityDescriptor = 0i64;
              ZwDeleteFile(&v8);
              RtlInitUnicodeString(&Directory, L"\\SystemRoot\\LastGood.Tmp", v5);
              IopFileUtilWalkDirectoryTreeBottomUp(&Directory);
              v8.RootDirectory = 0i64;
              v8.ObjectName = &Directory;
              v8.Length = 48;
              *(_OWORD *)&v8.SecurityDescriptor = 0i64;
              v8.Attributes = 64;
              ZwDeleteFile(&v8);
              CachedContextBaseKey = 0;
            }
          }
          else
          {
LABEL_25:
            CachedContextBaseKey = -1073741823;
          }
        }
      }
    }
    else
    {
      CachedContextBaseKey = -1073741727;
    }
    if( Handle )
      ZwClose(Handle);
    if( v17 )
      ZwClose(v17);
    if( KeyHandle )
      ZwClose(KeyHandle);
  }
  else
  {
    return(unsigned int)-1073741790;
  }
  return(unsigned int)CachedContextBaseKey;
}

Referenced by: