HalpRecordSecondaryGsivRange
VOID __fastcall HalpRecordSecondaryGsivRange(){
INT64 v0;
INT64 v1;
VOID *Data;
VOID *Dataa;
INT64 CreateOptions;
INT64 CreateOptionsa;
UINT64 CreateOptionsb;
UINT64 CreateOptionsc;
INT64 v8;
INT64 v9;
INT64 v10;
INT64 v11;
__int64 v12[2];
__int64 v13[2];
_UNICODE_STRING ValueName;
_UNICODE_STRING v15;
_OBJECT_ATTRIBUTES ObjectAttributes;
VOID *Handle;
VOID *KeyHandle;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ObjectAttributes.RootDirectory = 0i64;
KeyHandle = 0i64;
Handle = 0i64;
ValueName.Buffer = L"SecondaryGsivBase";
v15.Buffer = L"SecondaryGsivSize";
v12[1] = (__int64)L"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\Control\\HAL";
v13[1] = (__int64)L"SecondaryInterrupts";
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v12;
*(_QWORD *)&ValueName.Length = 2359330i64;
*(_QWORD *)&v15.Length = 2359330i64;
v12[0] = 7209068i64;
v13[0] = 2621478i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v0, (INT64)Data, CreateOptions, v8, v10) >= 0 )
{
ObjectAttributes.RootDirectory = KeyHandle;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v13;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwOpenKey(&Handle, 2ui64, &ObjectAttributes, v1, (INT64)Dataa, CreateOptionsa, v9, v11) >= 0
|| (LODWORD(CreateOptionsb) = 1,
ZwCreateKey(&Handle, 2ui64, &ObjectAttributes, 0i64, 0i64, CreateOptionsb, 0i64) >= 0) )
{
LODWORD(CreateOptionsb) = 4;
if( ZwSetValueKey(Handle, &ValueName, 0i64, 4ui64, (char *)&CmpDummyThreadEvent + 7852, CreateOptionsb) >= 0 )
{
LODWORD(CreateOptionsc) = 4;
ZwSetValueKey(Handle, &v15, 0i64, 4ui64, (char *)&CmpDummyThreadEvent + 7992, CreateOptionsc);
}
}
}
if( Handle )
ZwClose((_HANDLE)Handle);
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
}Referenced by:
HalpInitializeSecondaryInterruptServices