NtDisableLastKnownGood

NTSTATUS __stdcall NtDisableLastKnownGood(){
  int CachedContextBaseKey; 
  VOID *Data; 
  UINT64 DataSize; 
  _UNICODE_STRING KeyName; 
  int v5; 
  PVOID Handle; 
  INT64 v7; 

  v5 = 0;
  *(_DWORD *)(&KeyName.MaximumLength + 1) = 0;
  v7 = 0i64;
  Handle = 0i64;
  if( KeGetCurrentThread()->PreviousMode != 1 )
    return -1073741790;
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, 1) )
    return -1073741727;
  CachedContextBaseKey = PnpCtxGetCachedContextBaseKey(
                           *(&stru_140CF2E80 + 607),
                           PNPCTX_BASE_KEY_TYPE_CONTROLSET,
                           (VOID **)&v7);
  if( CachedContextBaseKey >= 0 )
  {
    LODWORD(Data) = 0;
    KeyName.Buffer = (wchar_t *)L"Control\\Pnp";
    *(_DWORD *)&KeyName.Length = 1572886;
    CachedContextBaseKey = IopCreateRegistryKeyEx(&Handle, (PVOID)v7, &KeyName, 0xF003Fui64, (UINT64)Data, 0i64);
    if( CachedContextBaseKey >= 0 )
    {
      KeyName.Buffer = (wchar_t *)L"DisableLKG";
      LODWORD(DataSize) = 4;
      v5 = 1;
      *(_DWORD *)&KeyName.Length = 1441812;
      CachedContextBaseKey = ZwSetValueKey(Handle, &KeyName, 0i64, 4ui64, &v5, DataSize);
    }
    if( Handle )
      ZwClose((_HANDLE)Handle);
  }
  return CachedContextBaseKey;
}

Referenced by: