PopCheckShutdownMarker

VOID __stdcall PopCheckShutdownMarker(_LOADER_PARAMETER_BLOCK *LoaderBlock, VOID *BootStatHandle){
  char v3; 
  char v4; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  UINT64 MatchingChangeStamp; 
  UINT64 CheckStamp; 
  _POP_SLEEP_CHECKPOINT CheckStampa; 
  CHAR ValueLength; 
  char v11; 
  bool v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  int v17; 
  int v18; 
  int Buffer; 
  UINT64 Attributes; 
  _WNF_STATE_NAME StateName; 
  _EVENT_DATA_DESCRIPTOR v22; 
  __int128 *v23; 
  __int64 v24; 
  int *v25; 
  __int64 v26; 
  int *v27; 
  __int64 v28; 
  __int128 *v29; 
  __int64 v30; 
  int *v31; 
  __int64 v32; 
  int *v33; 
  __int64 v34; 
  int *v35; 
  __int64 v36; 
  int *v37; 
  __int64 v38; 
  char *v39; 
  __int64 v40; 
  bool *v41; 
  __int64 v42; 
  int v43; 
  __int128 *v44; 
  int v45; 
  int v46; 
  __int128 *v47; 
  int v48; 
  int v49; 
  __int128 *v50; 
  int v51; 

  v43 = 14;
  v44 = &xmmword_140C50298;
  ValueLength = 0;
  v47 = &xmmword_140C502C8;
  v45 = 48;
  v50 = &xmmword_140C50488;
  v46 = 7;
  v48 = 32;
  v49 = 16;
  v51 = 32;
  RtlGetSystemBootStatusEx((__int64)&v43, 3u, 0i64);
  v3 = LoaderBlock->Extension->_bf_84 & 1;
  PopBsdPhysicalPowerButtonInfoAtBoot = xmmword_140C50298;
  PopLastBootSucceeded = v3;
  xmmword_140C54050 = xmmword_140C502A8;
  xmmword_140C54060 = xmmword_140C502B8;
  if( _mm_srli_si128((__m128i)xmmword_140C50298, 8).m128i_u32[0]
    && *(&stru_140C00F40 + 1194) > 5u
    && tlgKeywordOn((__int64)&stru_140C00F40 + 4776, 0x200000000000i64) )
  {
    v23 = &PopBsdPhysicalPowerButtonInfoAtBoot;
    v14 = v5;
    v13 = WORD2(v5);
    v25 = &v13;
    v27 = &v14;
    v29 = &xmmword_140C54050;
    v15 = WORD6(xmmword_140C54050);
    v31 = &v15;
    v33 = &v16;
    v35 = &v17;
    v18 = BYTE6(v5);
    v37 = &v18;
    v16 = v5;
    v6 = HIBYTE(v5);
    v11 = v6 & 1;
    v17 = HIWORD(*((_QWORD *)&xmmword_140C54050 + 1));
    v39 = &v11;
    v12 = (v6 & 2) != 0;
    v41 = &v12;
    v24 = 8i64;
    v26 = 4i64;
    v28 = 4i64;
    v30 = 8i64;
    v32 = 4i64;
    v34 = 4i64;
    v36 = 4i64;
    v38 = 4i64;
    v40 = 1i64;
    v42 = 1i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 4776,
      (unsigned __int8 *)&byte_140025E97,
      0i64,
      0i64,
      0xCu,
      &v22);
  }
  PopBsdPowerTransitionExtensionAtBoot = xmmword_140C50488;
  xmmword_140C540A0 = unk_140C50498;
  *(_OWORD *)&PopBsdPowerTransitionAtBoot = xmmword_140C502C8;
  xmmword_140C54080 = *(_OWORD *)&xmmword_140C502D8;
  if( (*(&ExBootDevicesRemovedEvent + 1112) & 4) != 0 )
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) &= ~1u;
  if( (*(&stru_140C23628 + 1164) & 0x200) != 0 )
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) |= 1u;
  v4 = *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) & 0xDF;
  *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) &= ~0x20u;
  if( DWORD2(PopBsdPhysicalPowerButtonInfoAtBoot) && (HIBYTE(PopBsdPhysicalPowerButtonInfoAtBoot) & 4) != 0 )
  {
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 14) = v4 | 0x20;
    PopBsdPowerTransitionAtBoot = PopBsdPhysicalPowerButtonInfoAtBoot;
  }
  LODWORD(CheckStamp) = 0;
  PopAutoChkCausedReboot = (BYTE14(xmmword_140C502C8) & 0x10) != 0;
  StateName = (_WNF_STATE_NAME)WNF_PO_PREVIOUS_SHUTDOWN_STATE;
  LODWORD(MatchingChangeStamp) = 0;
  Buffer = *(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 1;
  ZwUpdateWnfStateData(&StateName, &Buffer, 4ui64, 0i64, 0i64, MatchingChangeStamp, CheckStamp);
  if( (*(&stru_140C23628 + 1164) & 0x400) != 0 )
  {
    *((_WORD *)&PopBsdPowerTransitionAtBoot + 6) = 1;
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) = *(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 0xF | 0x50;
  }
  if( (*(&stru_140C23628 + 582) & 0x20000000) != 0 )
  {
    *((_BYTE *)&PopBsdPowerTransitionAtBoot + 8) |= 2u;
    *((_QWORD *)&xmmword_140C540A0 + 1) = 1i64;
  }
  if( (*(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 1) != 0 )
  {
    LODWORD(Attributes) = 1;
    if( ExGetFirmwareEnvironmentVariable(
           (const VOID **)&PopCheckpointSystemSleepVariable,
           (VOID *)&SYSTEM_SLEEP_ETW_CHECKPOINT_GUID,
           &ValueLength,
           &Attributes,
           0i64) < 0 )
    {
      BYTE1(PopBsdPowerTransitionExtensionAtBoot) = BYTE1(PopBsdPowerTransitionExtensionAtBoot) & 0xF3 | 8;
      PopRecordSleepCheckpointSource(2);
    }
    else
    {
      BYTE2(PopBsdPowerTransitionExtensionAtBoot) = ValueLength;
      BYTE1(PopBsdPowerTransitionExtensionAtBoot) = BYTE1(PopBsdPowerTransitionExtensionAtBoot) & 0xF3 | 4;
      PopRecordSleepCheckpoint(ValueLength);
      PopRecordSleepCheckpointSource(1);
      PopClearSystemSleepCheckpoint();
    }
    PopDiagTraceDirtyTransition(
      LoaderBlock,
      (_SYSTEM_POWER_STATE)(*((unsigned __int8 *)&PopBsdPowerTransitionAtBoot + 8) >> 4),
      *((unsigned __int16 *)&PopBsdPowerTransitionAtBoot + 6),
      (*(_BYTE *)(&PopBsdPowerTransitionAtBoot + 1) & 2) != 0,
      CsEntryScenarioInstanceId,
      PopBsdPowerTransitionAtBoot,
      CheckStampa);
  }
}

Referenced by: