PfpParametersInitialize

NTSTATUS __fastcall PfpParametersInitialize(__int64 a1){
  int v1; 
  WCHAR v3; 
  WCHAR v4; 
  PVOID *v5; 
  NTSTATUS result; 
  PVOID v7; 
  int *v8; 
  void *v9; 
  PVOID v10; 
  UINT64 CreateOptions; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING v13; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 v15; 
  v1 = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v13 = 0i64;
  DestinationString = 0i64;
  memset(a1, 0i64);
  *(_QWORD *)(a1 + 56) = a1;
  *(_QWORD *)(a1 + 48) = PfpParametersWatcher;
  *(_QWORD *)(a1 + 32) = 0i64;
  *(_QWORD *)(a1 + 72) = 0i64;
  *(_QWORD *)(a1 + 80) = 0i64;
  *(_QWORD *)(a1 + 88) = 0i64;
  *(_DWORD *)(a1 + 68) = 0x80000000;
  *(_DWORD *)(a1 + 80) = 16;
  *(_DWORD *)(a1 + 76) = 64;
  *(_DWORD *)(a1 + 84) = 5000;
  *(_DWORD *)(a1 + 88) = 10000;
  *(_DWORD *)(a1 + 92) = 10000;
  PfSnParametersSetDefaults(a1);
  RtlInitUnicodeString(&DestinationString, L"\\KernelObjects\\SuperfetchParametersChanged", v3);
  PfpCreateEvent(&DestinationString, SynchronizationEvent, (KEVENT **)a1);
  RtlInitUnicodeString(
    &v13,
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters",
    v4);
  LODWORD(CreateOptions) = 0;
  v5 = (PVOID *)(a1 + 8);
  ObjectAttributes.ObjectName = &v13;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwCreateKey((PVOID *)(a1 + 8), 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( result < 0 )
  {
    *v5 = 0i64;
  }
  else
  {
    PfpParametersRead(a1, 0.0);
    PfSnParametersRead(a1);
    v7 = *v5;
    LODWORD(v15) = 4;
    v8 = (int *)(a1 + 72);
    if( (int)PfpGetParameter(v7, (WCHAR *)L"BootId", 4ui64, (PVOID)(a1 + 72), &v15) >= 0 )
      v1 = *v8;
    v10 = *v5;
    *v8 = v1 + 1;
    PfpSetParameter(v10, (WCHAR *)L"BootId", v9, a1 + 72);
    return PfpSetBaseTime(*v5, (UINT64 *)(a1 + 540));
  }
  return result;
}

Referenced by: