IopBootLog

VOID __stdcall IopBootLog(_UNICODE_STRING *LogEntry, UINT8 Loaded){
  INT64 v2; 
  PUNICODE_STRING v5; 
  const _UNICODE_STRING *v6; 
  unsigned __int16 Length; 
  wchar_t *Buffer; 
  UINT64 DataSize; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING Source; 
  _UNICODE_STRING v12; 
  _UNICODE_STRING KeyName; 
  _UNICODE_STRING ValueName; 
  WCHAR pszDest[256]; 
  char v16; 

  *(_QWORD *)&DestinationString.Length = 0x1000000i64;
  DestinationString.Buffer = (wchar_t *)&v16;
  KeyName = 0i64;
  ValueName = 0i64;
  v12 = 0i64;
  Source = 0i64;
  if( qword_140D2C030 )
  {
    ExAcquireResourceExclusiveLite((UINT64)&qword_140D2C030[4], 1, v2);
    v5 = qword_140D2C030;
    v6 = qword_140D2C030;
    if( !Loaded )
      v6 = qword_140D2C030 + 1;
    RtlCopyUnicodeString(&DestinationString, v6);
    RtlInitUnicodeString(&Source, L" ");
    RtlAppendUnicodeStringToString(&DestinationString, &Source);
    RtlAppendUnicodeStringToString(&DestinationString, LogEntry);
    RtlInitUnicodeString(&v12, L"\r\n");
    RtlAppendUnicodeStringToString(&DestinationString, &v12);
    Length = DestinationString.Length;
    Buffer = DestinationString.Buffer;
    if( DestinationString.Length == DestinationString.MaximumLength )
    {
      Length = DestinationString.Length - 2;
      DestinationString.Length = Length;
      DestinationString.Buffer[(unsigned __int64)Length >> 1] = 0;
    }
    ++LODWORD(v5[10].Buffer);
    RtlStringCchPrintfW(pszDest, 0x100ui64, (WCHAR *)L"%d");
    RtlInitUnicodeString(&KeyName, pszDest);
    RtlInitUnicodeString(&ValueName, (PCWSTR)&dword_1407CF120);
    if( BYTE4(qword_140D2C030[10].Buffer) )
    {
      IopBootLogToFile(&DestinationString);
    }
    else
    {
      *(_QWORD *)&Source.Length = 0i64;
      *(_QWORD *)&DestinationString.Length = 0i64;
      if( IopOpenRegistryKey(
             (PVOID *)&DestinationString,
             0i64,
             &CmRegistryMachineSystemCurrentControlSetControlBootLog,
             0xF003Fui64,
             1u) >= 0 )
      {
        if( IopOpenRegistryKey((PVOID *)&Source, *(PVOID *)&DestinationString.Length, &KeyName, 0xF003Fui64, 1u) >= 0 )
        {
          LODWORD(DataSize) = Length + 2;
          ZwSetValueKey(*(VOID **)&Source.Length, &ValueName, 0i64, 1ui64, Buffer, DataSize);
          ZwClose(*(_HANDLE *)&Source.Length);
        }
        ZwClose(*(_HANDLE *)&DestinationString.Length);
      }
    }
    ExReleaseResourceLite((PERESOURCE)&qword_140D2C030[4]);
  }
}

Referenced by: