PfpParametersInitialize

NTSTATUS __stdcall PfpParametersInitialize(PFP_SUPERFETCH_PARAMETERS *SuperfetchParameters){
  PFP_SUPERFETCH_PARAMETERS v1; 
  VOID **v3; 
  NTSTATUS result; 
  VOID *v5; 
  PFP_SUPERFETCH_PARAMETERS *v6; 
  VOID *v7; 
  VOID *v8; 
  UINT64 v9; 
  _UNICODE_STRING *Class; 
  UINT64 CreateOptions; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v13; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 ValueSize; 

  v1 = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v13 = 0i64;
  DestinationString = 0i64;
  memset(SuperfetchParameters, 0i64, 0x220u);
  *((_QWORD *)SuperfetchParameters + 7) = SuperfetchParameters;
  *((_QWORD *)SuperfetchParameters + 6) = PfpParametersWatcher;
  *((_QWORD *)SuperfetchParameters + 4) = 0i64;
  *((_QWORD *)SuperfetchParameters + 9) = 0i64;
  *((_QWORD *)SuperfetchParameters + 10) = 0i64;
  *((_QWORD *)SuperfetchParameters + 11) = 0i64;
  SuperfetchParameters[17] = 0x80000000;
  SuperfetchParameters[20] = 16;
  SuperfetchParameters[19] = 64;
  SuperfetchParameters[21] = 5000;
  SuperfetchParameters[22] = 10000;
  SuperfetchParameters[23] = 10000;
  PfSnParametersSetDefaults((INT64)SuperfetchParameters);
  RtlInitUnicodeString(&DestinationString, L"\\KernelObjects\\SuperfetchParametersChanged");
  PfpCreateEvent(&DestinationString, SynchronizationEvent, (PVOID *)SuperfetchParameters);
  RtlInitUnicodeString(
    &v13,
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters");
  LODWORD(CreateOptions) = 0;
  v3 = (VOID **)(SuperfetchParameters + 2);
  ObjectAttributes.ObjectName = &v13;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwCreateKey(
             (VOID **)SuperfetchParameters + 1,
             0xF003Fui64,
             &ObjectAttributes,
             0i64,
             0i64,
             CreateOptions,
             0i64);
  if( result < 0 )
  {
    *v3 = 0i64;
  }
  else
  {
    PfpParametersRead(SuperfetchParameters);
    PfSnParametersRead(SuperfetchParameters);
    v5 = *v3;
    LODWORD(ValueSize) = 4;
    v6 = SuperfetchParameters + 18;
    if( PfpGetParameter(v5, (WCHAR *)L"BootId", 4ui64, SuperfetchParameters + 18, &ValueSize) >= 0 )
      v1 = *v6;
    v8 = *v3;
    *v6 = v1 + 1;
    LODWORD(Class) = ValueSize;
    PfpSetParameter(v8, (WCHAR *)L"BootId", v7, SuperfetchParameters + 18, (UINT64)Class);
    return PfpSetBaseTime(*v3, (UINT64 *)(SuperfetchParameters + 135), v9);
  }
  return result;
}

Referenced by: