IopCopyBootLogRegistryToFile

VOID __stdcall IopCopyBootLogRegistryToFile(){
  INT64 v0; 
  _ETHREAD *CurrentThread; 
  INT64 v2; 
  unsigned int i; 
  NTSTATUS RegistryValue; 
  _KEY_VALUE_FULL_INFORMATION *v5; 
  PUNICODE_STRING v6; 
  PVOID Handle; 
  PVOID TimeFields; 
  _TIME_FIELDS TimeFields_8; 
  _LARGE_INTEGER LocalTime; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  _UNICODE_STRING String; 
  _STRING DestinationString; 
  _UNICODE_STRING KeyName; 
  _UNICODE_STRING v15; 
  INT8 pszDest[256]; 
  WCHAR SourceString[256]; 

  Handle = 0i64;
  TimeFields = 0i64;
  LocalTime.QuadPart = 0i64;
  KeyName = 0i64;
  TimeFields_8 = 0i64;
  DestinationString = 0i64;
  String = 0i64;
  v15 = 0i64;
  if( qword_140D2C030 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceExclusiveLite((UINT64)&qword_140D2C030[4], 1, v0);
    IopBootLogToFile(qword_140D2C030 + 3);
    ExSystemTimeToLocalTime(&KeBootTime, &LocalTime);
    RtlTimeToTimeFields((INT64 *)&LocalTime, (WORD *)&TimeFields_8, v2);
    RtlStringCchPrintfA(pszDest, 0x100ui64, (INT8 *)"%2d %2d %4d %02d:%02d:%02d.%03d\r\n");
    RtlInitAnsiString(&DestinationString, pszDest);
    RtlAnsiStringToUnicodeString(&String, &DestinationString, 1u);
    IopBootLogToFile(&String);
    RtlFreeAnsiString(&String);
    if( IopOpenRegistryKey(&TimeFields, 0i64, &CmRegistryMachineSystemCurrentControlSetControlBootLog, 0xF003Fui64, 0) < 0 )
    {
      v6 = qword_140D2C030;
    }
    else
    {
      for( i = 0; i < LODWORD(qword_140D2C030[10].Buffer); ++i )
      {
        RtlStringCchPrintfW(SourceString, 0x100ui64, (WCHAR *)L"%d");
        RtlCreateUnicodeString((INT64)&KeyName, (INT8 *)SourceString);
        if( IopOpenRegistryKey(&Handle, TimeFields, &KeyName, 0xF003Fui64, 0) >= 0 )
        {
          Information = 0i64;
          RegistryValue = IopGetRegistryValue(Handle, (PWCHAR)&dword_1407CF120, 0x100ui64, &Information);
          v5 = Information;
          if( RegistryValue >= 0 )
          {
            RtlInitUnicodeString(&v15, (PCWSTR)((char *)Information + Information->DataOffset));
            IopBootLogToFile(&v15);
          }
          ExFreePoolWithTag(v5, 0);
          ZwDeleteKey(Handle);
          ZwClose((_HANDLE)Handle);
        }
      }
      ZwDeleteKey(TimeFields);
      ZwClose((_HANDLE)TimeFields);
      v6 = qword_140D2C030;
      BYTE4(qword_140D2C030[10].Buffer) = 1;
    }
    ExReleaseResourceLite((PERESOURCE)&v6[4]);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  }
}

Referenced by: