IopProtectSystemPartition

UINT8 __stdcall IopProtectSystemPartition(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  INT64 v2; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v7; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING ValueName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[80]; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LODWORD(v7) = 0;
  DestinationString = 0i64;
  ValueName = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( NtOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v2, Length, (INT64)ResultLength, v7, 0i64) >= 0 )
  {
    RtlInitUnicodeString(&ValueName, L"Protect System Partition");
    LODWORD(Lengtha) = 20;
    if( NtQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, Lengtha, &v7) >= 0
      && KeyValueInformation[12] )
    {
      IopApplySystemPartitionProt(LoaderBlock);
    }
    NtClose((UINT64)KeyHandle);
  }
  return 1;
}

Referenced by: