ExpRecordShutdownTime

VOID __stdcall ExpRecordShutdownTime(){
  INT64 v0; 
  VOID *Data; 
  INT64 DataSize; 
  UINT64 DataSizea; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING ValueName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 
  __int64 v8; 

  KeyHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  ValueName = 0i64;
  v8 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Windows");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(
         &KeyHandle,
         0x2001Fui64,
         &ObjectAttributes,
         v0,
         (INT64)Data,
         DataSize,
         *(INT64 *)&DestinationString.Length,
         (INT64)DestinationString.Buffer) >= 0 )
  {
    RtlInitUnicodeString(&ValueName, L"ShutdownTime");
    LODWORD(DataSizea) = 8;
    ZwSetValueKey(KeyHandle, &ValueName, 0i64, 3ui64, &v8, DataSizea);
    ZwFlushKey(KeyHandle);
    ZwClose((_HANDLE)KeyHandle);
  }
}

Referenced by: