SepSecureBootSetRegistryKey
__int64 __fastcall SepSecureBootSetRegistryKey(__int64 a1){
int v2;
UINT64 CreateOptions;
UINT64 CreateOptionsa;
UINT64 CreateOptionsb;
UINT64 CreateOptionsc;
struct _UNICODE_STRING UnicodeString;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
int Data;
HANDLE Handle;
HANDLE KeyHandle;
KeyHandle = 0i64;
Handle = 0i64;
Data = 0;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
UnicodeString = 0i64;
if( (dword_140C54384 & 8) == 0 && !a1 )
{
v2 = 0;
goto LABEL_4;
}
LODWORD(CreateOptions) = 0;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"z|";
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v2 = ZwCreateKey(&KeyHandle, 0x20006ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
if( v2 >= 0 )
{
ObjectAttributes.RootDirectory = KeyHandle;
LODWORD(CreateOptionsa) = 1;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&qword_1400097C0;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v2 = ZwCreateKey(&Handle, 0x20006ui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsa, 0i64);
if( v2 >= 0 )
{
if( (dword_140C54384 & 8) != 0 )
{
LODWORD(CreateOptionsb) = 4;
Data = dword_140C54384 & 1;
v2 = ZwSetValueKey(Handle, (UNICODE_STRING *)&stru_140009790, 0i64, 4ui64, &Data, CreateOptionsb);
if( v2 < 0 )
goto LABEL_4;
if( Data )
_interlockedbittestandset((volatile signed __int32 *)&KUSER_SHARED_DATA.SharedDataFlags, 7u);
}
if( a1 )
{
v2 = RtlStringFromGUID((const _GUID *const)(a1 + 4), &UnicodeString);
if( v2 >= 0 )
{
LODWORD(CreateOptionsb) = UnicodeString.Length + 2;
v2 = ZwSetValueKey(
Handle,
(UNICODE_STRING *)&stru_140009780,
0i64,
1ui64,
UnicodeString.Buffer,
CreateOptionsb);
if( v2 >= 0 )
{
LODWORD(CreateOptionsc) = 4;
v2 = ZwSetValueKey(Handle, (UNICODE_STRING *)&stru_1400097B0, 0i64, 4ui64, (PVOID)(a1 + 20), CreateOptionsc);
}
}
}
}
}
LABEL_4:
RtlFreeAnsiString(&UnicodeString);
if( Handle )
ZwClose(Handle);
if( KeyHandle )
ZwClose(KeyHandle);
return(unsigned int)v2;
}Referenced by:
SeSecureBootRegisterPolicy