SecureDump_PrepareForInit

VOID __fastcall SecureDump_PrepareForInit(INT64 a1, BYTE *a2){
  unsigned int v3; 
  NTSTATUS v4; 
  INT64 v5; 
  EVENT_DESCRIPTOR *v6; 
  NTSTATUS v7; 
  UNICODE_STRING v8; 
  UNICODE_STRING KeyName; 
  UNICODE_STRING v10; 
  INT64 a5; 
  PVOID P; 
  P = 0i64;
  v8.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl\\EncryptionCertificates\\Certificate.1";
  v10.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl";
  KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl\\ForceDumpsDisabled";
  *(_QWORD *)&v8.Length = 13238472i64;
  v3 = 2;
  *(_QWORD *)&v10.Length = 8388734i64;
  *(_QWORD *)&KeyName.Length = 10879140i64;
  ForceDumpDisabled = 1;
  if( !a2 )
    return;
  *a2 = 0;
  xmmword_140C4C598 = 0i64;
  *(_OWORD *)dwFlags = 0i64;
  v4 = SecureDump_ReadRegistry(&KeyName, (PWCHAR)L"GuardedHost", 4i64, (UINT8 **)&P, (INT64)&a5);
  if( v4 >= 0 )
  {
    LODWORD(xmmword_140C4C598) = *(_DWORD *)P;
    ExFreePoolWithTag(P, 0);
    P = 0i64;
    if( !(_DWORD)xmmword_140C4C598 )
    {
LABEL_4:
      v7 = SecureDump_ReadRegistry(&v10, (PWCHAR)L"DumpEncryptionEnabled", 4i64, (UINT8 **)&P, (INT64)&a5);
      if( v7 >= 0 )
      {
        DWORD1(xmmword_140C4C598) = *(_DWORD *)P;
        ExFreePoolWithTag(P, 0);
        if( !DWORD1(xmmword_140C4C598)
          || (*a2 = 1,
              SecureDump_ReadRegistry(&v8, (PWCHAR)L"PublicKey", 3i64, (UINT8 **)&xmmword_140C4C598 + 1, (INT64)dwFlags) >= 0)
          && SecureDump_ReadRegistry(&v8, (PWCHAR)L"Thumbprint", 1i64, (UINT8 **)dwFlags + 1, (INT64)dwFlags + 4) >= 0 )
        {
          ForceDumpDisabled = 0;
          goto LABEL_8;
        }
      }
      else if( v7 == -1073741772 )
      {
        v3 = 0;
        ForceDumpDisabled = 0;
      }
      goto LABEL_7;
    }
    v3 = 0;
  }
  else if( v4 == -1073741772 )
  {
    goto LABEL_4;
  }
LABEL_7:
  if( ForceDumpDisabled != 1 )
  {
LABEL_8:
    SecureDmpEncryptionContext = 1;
    return;
  }
  if( *((_QWORD *)&xmmword_140C4C598 + 1) )
  {
    ExFreePoolWithTag(*((PVOID *)&xmmword_140C4C598 + 1), 0);
    *((_QWORD *)&xmmword_140C4C598 + 1) = 0i64;
  }
  if( v3 )
  {
    SecureDmpEncryptionContext = 3;
    SecureDump_LogErrorEvent(v3, v5, v6);
  }
}

Referenced by: