CmpCreateControlSet

NTSTATUS __stdcall CmpCreateControlSet(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  char v1; 
  char v2; 
  int ValueKey; 
  INT64 v4; 
  INT64 v5; 
  NTSTATUS v6; 
  INT64 Length; 
  INT64 Lengtha; 
  UINT64 Lengthb; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  UINT64 *ResultLengthb; 
  UINT64 *ResultLengthc; 
  UINT64 *ResultLengthd; 
  UINT64 *ResultLengthe; 
  UINT64 *Disposition; 
  UINT64 *Dispositiona; 
  INT64 v19; 
  INT64 v20; 
  int Data; 
  char v22[20]; 
  VOID *Handle; 
  UINT64 v24; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v27[2]; 
  int KeyValueInformation[32]; 
  char v29[256]; 

  *(_QWORD *)&v22[4] = 0x1000000i64;
  LODWORD(v27[0]) = 0;
  v2 = v1;
  *(_DWORD *)v22 = 0;
  *(_QWORD *)&v22[12] = v29;
  KeyHandle = 0i64;
  v24 = 0i64;
  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Data = 0;
  ValueKey = RtlUnicodeStringPrintf((_UNICODE_STRING *)&v22[4], (WCHAR *)L"\\Registry\\Machine\\%ws");
  if( ValueKey >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v22[4];
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    ValueKey = ZwOpenKey(
                 &KeyHandle,
                 0x20019ui64,
                 &ObjectAttributes,
                 v4,
                 Length,
                 (INT64)ResultLength,
                 (INT64)Disposition,
                 v19);
    if( ValueKey >= 0 )
    {
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&CmpSelectString;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v6 = ZwOpenKey(
             (VOID **)&v24,
             0x20019ui64,
             &ObjectAttributes,
             v5,
             Lengtha,
             (INT64)ResultLengtha,
             (INT64)Dispositiona,
             v20);
      ValueKey = v6;
      if( v6 == -1073741772 )
      {
        if( !v2 )
          goto LABEL_10;
        LODWORD(ResultLengthb) = 0;
        ValueKey = ZwCreateKey(
                     (VOID **)&v24,
                     0x20019ui64,
                     &ObjectAttributes,
                     0i64,
                     0i64,
                     (UINT64)ResultLengthb,
                     (UINT64 *)v22);
        if( ValueKey < 0 )
          goto LABEL_10;
        Data = 1;
        LODWORD(ResultLengthd) = 4;
        ValueKey = ZwSetValueKey(
                     (VOID *)v24,
                     (_UNICODE_STRING *)&CmpCurrentString,
                     0i64,
                     4ui64,
                     &Data,
                     (UINT64)ResultLengthd);
        if( ValueKey < 0 )
          goto LABEL_10;
        *(_QWORD *)&v22[4] = 0x1000000i64;
        *(_QWORD *)&v22[12] = v29;
        RtlUnicodeStringPrintf((_UNICODE_STRING *)&v22[4], (WCHAR *)L"ControlSet%03d");
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v22[4];
        ObjectAttributes.Attributes = 576;
        LODWORD(ResultLengthe) = 0;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        ValueKey = ZwCreateKey(
                     &Handle,
                     0x20019ui64,
                     &ObjectAttributes,
                     0i64,
                     0i64,
                     (UINT64)ResultLengthe,
                     (UINT64 *)v22);
        if( ValueKey < 0 )
          goto LABEL_10;
        ZwClose((_HANDLE)Handle);
        Handle = 0i64;
      }
      else if( v6 < 0 )
      {
        goto LABEL_10;
      }
      if( !Data )
      {
        LODWORD(Lengthb) = 128;
        ValueKey = ZwQueryValueKey(
                     (VOID *)v24,
                     (_UNICODE_STRING *)&CmpCurrentString,
                     KeyValueFullInformation,
                     KeyValueInformation,
                     Lengthb,
                     (UINT64 *)v27);
        if( ValueKey < 0 )
          goto LABEL_10;
        Data = *(int *)((char *)KeyValueInformation + (unsigned int)KeyValueInformation[2]);
      }
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"\"$";
      ObjectAttributes.Attributes = 576;
      LODWORD(ResultLengthb) = 3;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      ValueKey = ZwCreateKey(&Handle, 0x20ui64, &ObjectAttributes, 0i64, 0i64, (UINT64)ResultLengthb, (UINT64 *)v22);
      if( ValueKey >= 0 )
      {
        *(_QWORD *)&v22[4] = 0x1000000i64;
        *(_QWORD *)&v22[12] = v29;
        RtlUnicodeStringPrintf((_UNICODE_STRING *)&v22[4], (WCHAR *)L"\\Registry\\Machine\\%ws\\ControlSet%03d");
        LODWORD(ResultLengthc) = *(unsigned __int16 *)&v22[4];
        ValueKey = ZwSetValueKey(
                     Handle,
                     &CmSymbolicLinkValueName,
                     0i64,
                     6ui64,
                     *(VOID **)&v22[12],
                     (UINT64)ResultLengthc);
      }
    }
  }
LABEL_10:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( v24 )
    ZwClose(v24);
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return ValueKey;
}

Referenced by: