PopReadHiberbootGroupPolicy

NTSTATUS __stdcall PopReadHiberbootGroupPolicy(UINT8 *Hiberboot){
  INT64 v2; 
  int v3; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v8; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v13; 

  KeyHandle = 0i64;
  LODWORD(v8) = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  *Hiberboot = 0;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\System");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v3 = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v2, Length, (INT64)ResultLength, v8, (INT64)KeyHandle);
  if( v3 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"HiberbootEnabled");
    v13 = 0;
    LODWORD(Lengtha) = 20;
    KeyValueInformation = 0i64;
    v3 = ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v8);
    if( v3 >= 0 )
      *Hiberboot = BYTE12(KeyValueInformation);
    ZwClose((_HANDLE)KeyHandle);
  }
  return v3;
}

Referenced by: