PopUpdateUpgradeInProgress

NTSTATUS __stdcall PopUpdateUpgradeInProgress(_HANDLE KeyHandle){
  __int64 v1; 
  VOID *v2; 
  INT64 v3; 
  NTSTATUS result; 
  UINT64 Length; 
  UINT64 *ResultLength; 
  INT64 Asynchroneous; 
  INT64 v8; 
  VOID *KeyHandlea; 
  UINT64 v10; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v14; 

  LODWORD(v10) = 0;
  KeyHandlea = *(VOID **)&KeyHandle;
  v14 = 0;
  v1 = *(_QWORD *)&KeyHandle;
  v2 = *(VOID **)&KeyHandle;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyValueInformation = 0i64;
  DestinationString = 0i64;
  if( !*(_QWORD *)&KeyHandle )
  {
    RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\Setup");
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    result = ZwOpenKey(&KeyHandlea, 0x20019ui64, &ObjectAttributes, v3, Length, (INT64)ResultLength, Asynchroneous, v8);
    if( result < 0 )
      goto LABEL_13;
    v2 = KeyHandlea;
  }
  RtlInitUnicodeString(&DestinationString, L"SystemSetupInProgress");
  LODWORD(Length) = 20;
  result = ZwQueryValueKey(v2, &DestinationString, KeyValuePartialInformation, &KeyValueInformation, Length, &v10);
  if( result < 0 || *(_QWORD *)((char *)&KeyValueInformation + 4) != 0x400000004i64 || !HIDWORD(KeyValueInformation) )
  {
    if( v1 )
    {
      PopAcquirePolicyLock();
      PopRemoveReasonRecordByReasonCode(0xFui64);
      PopReleasePolicyLock();
    }
    goto LABEL_13;
  }
  if( !v1 && (result = PopLogSleepDisabled(0xFui64, 8ui64, 0i64, 0i64), result < 0)
    || (*(&stru_140C23628 + 783) = 0i64,
        *(&stru_140C23628 + 785) = PopUpdateUpgradeInProgress,
        *(&stru_140C23628 + 786) = KeyHandlea,
        result = ZwNotifyChangeKey(
                   (_HANDLE)KeyHandlea,
                   0,
                   (PIO_APC_ROUTINE)((char *)&stru_140C23628 + 6264),
                   (PVOID)1,
                   (PIO_STATUS_BLOCK)((char *)&stru_140C23628 + 6296),
                   4u,
                   0,
                   0i64,
                   0,
                   1u),
        result < 0) )
  {
LABEL_13:
    if( KeyHandlea )
      return ZwClose((_HANDLE)KeyHandlea);
  }
  return result;
}

Referenced by: