CMFRegisterEventTime

NTSTATUS __stdcall CMFRegisterEventTime(UINT16 EventType){
  WCHAR v1; 
  int v2; 
  NTSTATUS result; 
  WCHAR v4; 
  const WCHAR *v5; 
  WCHAR v6; 
  WCHAR v7; 
  NTSTATUS v8; 
  PULONG ResultLength; 
  PULONG ResultLengtha; 
  PULONG ResultLengthb; 
  void *KeyHandle; 
  ULONG v13; 
  struct _UNICODE_STRING ValueName; 
  __int64 v15; 
  struct _UNICODE_STRING DestinationString; 
  UNICODE_STRING v17; 
  UNICODE_STRING v18; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v21; 
  char Data[12]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  v13 = 0;
  v2 = EventType;
  DestinationString = 0i64;
  ValueName = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CMF\\SqmData", v1);
  LODWORD(ResultLength) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 576;
  result = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, (UINT64)ResultLength, 0i64);
  if( result >= 0 )
  {
    v15 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    if( v2 == 1 )
    {
      RtlInitUnicodeString(&ValueName, L"CMFStartTime", v4);
      if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, 0x14u, &v13) >= 0
        && v21 == 11 )
      {
        v17 = 0i64;
        RtlInitUnicodeString(&v17, L"CMFLastStartTime", v6);
        LODWORD(ResultLengthb) = 8;
        ZwSetValueKey(KeyHandle, &v17, 0i64, 0xBui64, Data, (UINT64)ResultLengthb);
      }
      RtlInitUnicodeString(&ValueName, L"SystemStartTime", v6);
      if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, 0x14u, &v13) >= 0
        && v21 == 11 )
      {
        v18 = 0i64;
        RtlInitUnicodeString(&v18, L"SystemLastStartTime", v7);
        LODWORD(ResultLengtha) = 8;
        ZwSetValueKey(KeyHandle, &v18, 0i64, 0xBui64, Data, (UINT64)ResultLengtha);
      }
    }
    else
    {
      if( v2 == 2 )
      {
        v5 = L"CMFStartTime";
      }
      else
      {
        if( v2 != 4 )
          return -1073741811;
        v5 = L"CMFStopTime";
      }
      RtlInitUnicodeString(&ValueName, v5, v4);
    }
    LODWORD(ResultLengtha) = 8;
    v8 = ZwSetValueKey(KeyHandle, &ValueName, 0i64, 0xBui64, &v15, (UINT64)ResultLengtha);
    ZwClose(KeyHandle);
    return v8;
  }
  return result;
}

Referenced by: