BapdpMarshallBootDataToRegistry

VOID __stdcall BapdpMarshallBootDataToRegistry(){
  __int64 *v0; 
  UNICODE_STRING *Class; 
  __int64 *v2; 
  unsigned int v3; 
  __int64 v4; 
  __int64 v5; 
  unsigned int v6; 
  _QWORD *PoolWithTag; 
  WCHAR v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  WCHAR v12; 
  unsigned int v13; 
  struct _UNICODE_STRING **v14; 
  struct _UNICODE_STRING *v15; 
  struct _UNICODE_STRING v16; 
  unsigned int v17; 
  char *v18; 
  _QWORD *v19; 
  unsigned __int64 v20; 
  UINT64 v21; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  void *KeyHandle; 
  PVOID ObjectAttributes[7]; 
  _UNICODE_STRING GuidString; 
  struct _UNICODE_STRING String; 
  HANDLE Handle; 
  __int64 v29; 
  struct _UNICODE_STRING DestinationString; 
  char v31; 
  char v32; 
  v0 = (__int64 *)qword_140CF2570;
  Class = 0i64;
  Handle = (HANDLE)0x43F585FA729AF26Ei64;
  v2 = (__int64 *)qword_140CF2570;
  v3 = 0;
  v29 = 0x55C1EB7445F20CB8i64;
  KeyHandle = 0i64;
  ObjectAttributes[0] = 0i64;
  if( qword_140CF2570 )
  {
    do
    {
      if( v2 == &qword_140CF2570 )
        break;
      v4 = v2[2];
      v2 = (__int64 *)*v2;
      if( (unsigned int)(*(_DWORD *)(v4 + 32) - 1) <= 1 )
      {
        v5 = *(_QWORD *)(v4 + 16) - (_QWORD)Handle;
        if( !v5 )
          v5 = *(_QWORD *)(v4 + 24) - v29;
        if( !v5 )
          ++v3;
      }
    }
    while( v2 );
    if( v3 )
    {
      v6 = 0;
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, 8i64 * v3, 0x64506142ui64);
      if( PoolWithTag )
      {
        while( v0 != &qword_140CF2570 )
        {
          v9 = v0[2];
          v0 = (__int64 *)*v0;
          if( (unsigned int)(*(_DWORD *)(v9 + 32) - 1) <= 1 )
          {
            v10 = *(_QWORD *)(v9 + 16) - (_QWORD)Handle;
            if( !v10 )
              v10 = *(_QWORD *)(v9 + 24) - v29;
            if( !v10 )
            {
              v11 = v6++;
              PoolWithTag[v11] = v9;
            }
          }
        }
        ObjectAttributes[1] = (PVOID)48;
        ObjectAttributes[4] = (PVOID)576;
        DestinationString = 0i64;
        RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control", v8);
        ObjectAttributes[2] = 0i64;
        ObjectAttributes[3] = &DestinationString;
        *(_OWORD *)&ObjectAttributes[5] = 0i64;
        if( ZwOpenKey(&KeyHandle, 0x20019u, (POBJECT_ATTRIBUTES)&ObjectAttributes[1]) < 0 )
        {
          KeyHandle = 0i64;
LABEL_40:
          if( ObjectAttributes[0] )
            ZwClose(ObjectAttributes[0]);
          if( PoolWithTag )
            ExFreePoolWithTag(PoolWithTag, 0x64506142u);
          return;
        }
        ObjectAttributes[1] = (PVOID)48;
        ObjectAttributes[4] = (PVOID)576;
        DestinationString = 0i64;
        RtlInitUnicodeString(&DestinationString, L"BootApplicationPersistentData", v12);
        ObjectAttributes[2] = KeyHandle;
        LODWORD(CreateOptions) = 1;
        ObjectAttributes[3] = &DestinationString;
        *(_OWORD *)&ObjectAttributes[5] = 0i64;
        if( ZwCreateKey(
               ObjectAttributes,
               0x6001Fui64,
               (OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
               0i64,
               0i64,
               CreateOptions,
               0i64) >= 0 )
        {
          v13 = 0;
          v14 = (struct _UNICODE_STRING **)PoolWithTag;
          do
          {
            v15 = *v14;
            Handle = Class;
            if( v15 )
            {
              v16 = *v15;
              *(_QWORD *)&GuidString.Length = 5111808i64;
              GuidString.Buffer = (wchar_t *)&v32;
              DestinationString = v16;
              memset(&ObjectAttributes[1], 0, 48);
              if( (int)RtlStringFromGUIDEx((const _GUID *const)&DestinationString, &GuidString, 0) >= 0 )
              {
                ObjectAttributes[2] = ObjectAttributes[0];
                LODWORD(CreateOptionsa) = 1;
                ObjectAttributes[3] = &GuidString;
                LODWORD(ObjectAttributes[1]) = 48;
                LODWORD(ObjectAttributes[4]) = 576;
                *(_OWORD *)&ObjectAttributes[5] = 0i64;
                if( ZwCreateKey(
                       &Handle,
                       0x6001Fui64,
                       (OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
                       0i64,
                       Class,
                       CreateOptionsa,
                       (UINT64 *)&Class->Length) >= 0 )
                {
                  v17 = (unsigned int)Class;
                  if( v13 < v3 )
                  {
                    Class = (UNICODE_STRING *)(v3 - v13);
                    v18 = (char *)&PoolWithTag[v13];
                    do
                    {
                      v19 = *(_QWORD **)v18;
                      *(_QWORD *)&String.Length = 1572864i64;
                      String.Buffer = (wchar_t *)&v31;
                      if( v19 )
                      {
                        v20 = *v19 - *(_QWORD *)&DestinationString.Length;
                        if( *v19 == *(_QWORD *)&DestinationString.Length )
                          v20 = v19[1] - (unsigned __int64)DestinationString.Buffer;
                        if( !v20 )
                        {
                          v21 = v17++;
                          if( RtlIntegerToUnicodeString(v21, 0xAui64, &String) >= 0 )
                          {
                            LODWORD(CreateOptionsa) = *(_DWORD *)(*(_QWORD *)v18 + 36i64);
                            ZwSetValueKey(
                              Handle,
                              &String,
                              0i64,
                              3ui64,
                              (PVOID)(*(_QWORD *)v18 + *(unsigned int *)(*(_QWORD *)v18 + 40i64)),
                              CreateOptionsa);
                            *(_QWORD *)v18 = 0i64;
                          }
                        }
                      }
                      v18 += 8;
                      Class = (UNICODE_STRING *)((char *)Class - 1);
                    }
                    while( Class );
                  }
                  ZwClose(Handle);
                }
              }
            }
            ++v13;
            ++v14;
          }
          while( v13 < v3 );
        }
        else
        {
          ObjectAttributes[0] = 0i64;
        }
      }
      if( KeyHandle )
        ZwClose(KeyHandle);
      goto LABEL_40;
    }
  }
}

Referenced by: