RegistryOverwriteCentralProcessor

NTSTATUS __stdcall RegistryOverwriteCentralProcessor(){
  INT64 v0; 
  int v1; 
  unsigned int v2; 
  UINT64 i; 
  INT64 v4; 
  wchar_t *Buffer; 
  int v6; 
  INT64 v8; 
  INT64 v9; 
  INT64 v10; 
  INT64 v11; 
  INT64 v12; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15; 
  VOID *Handle; 
  VOID *KeyHandle; 
  _UNICODE_STRING ValueName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _UNICODE_STRING v20; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v22; 
  __int128 KeyInformation; 
  WCHAR SourceString[8]; 
  __int64 v25; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  KeyHandle = 0i64;
  LODWORD(v15) = 0;
  v25 = 0i64;
  DestinationString = 0i64;
  v22 = 0i64;
  ValueName = 0i64;
  KeyInformation = 0i64;
  *(_OWORD *)SourceString = 0i64;
  v20 = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\Hardware\\Description\\System\\CentralProcessor");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v1 = ZwOpenKey(&KeyHandle, 8ui64, &ObjectAttributes, v0, v8, v10, v15, 0i64);
  if( v1 >= 0 )
  {
    v2 = 0;
    for( i = 0i64; ; i = v2 )
    {
      LODWORD(v9) = 38;
      v1 = ZwEnumerateKey(KeyHandle, i, KeyBasicInformation, &KeyInformation, v9, (UINT64 *)&v15);
      if( v1 == -2147483622 )
        break;
      ++v2;
      if( v1 >= 0 )
      {
        SourceString[(unsigned __int64)HIDWORD(KeyInformation) >> 1] = 0;
        RtlInitUnicodeString(&v22, SourceString);
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = &v22;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( ZwOpenKey(&Handle, 0xF003Fui64, &ObjectAttributes, v4, v9, v14, v15, (INT64)Handle) >= 0 )
        {
          RtlInitUnicodeString(&v20, L"Not Available");
          RtlInitUnicodeString(&ValueName, L"VendorIdentifier");
          Buffer = v20.Buffer;
          v6 = v20.Length + 2;
          LODWORD(v11) = v6;
          ZwSetValueKey(Handle, &ValueName, 0i64, 1ui64, v20.Buffer, v11);
          RtlInitUnicodeString(&ValueName, L"ProcessorNameString");
          LODWORD(v12) = v6;
          ZwSetValueKey(Handle, &ValueName, 0i64, 1ui64, Buffer, v12);
          RtlInitUnicodeString(&ValueName, L"Identifier");
          LODWORD(v13) = v6;
          ZwSetValueKey(Handle, &ValueName, 0i64, 1ui64, Buffer, v13);
          ZwClose((_HANDLE)Handle);
        }
      }
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v1;
}

Referenced by: