IopLiveDumpInitRegistrySettings

VOID __stdcall IopLiveDumpInitRegistrySettings(INT64 a1){
  _KEY_VALUE_FULL_INFORMATION *v2; 
  int v3; 
  NTSTATUS RegistryValue; 
  unsigned __int64 v5; 
  _UNICODE_STRING KeyName; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  PVOID Handle; 

  Handle = 0i64;
  KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\LiveDump";
  v2 = 0i64;
  *(_QWORD *)&KeyName.Length = 7864438i64;
  Information = 0i64;
  if( IopOpenRegistryKey(&Handle, 0i64, &KeyName, 0x20019ui64, 0) >= 0 )
  {
    if( IopGetRegistryValue(Handle, (PWCHAR)L"BufferAllocationScheme", 4ui64, &Information) >= 0
      && Information->Type == 4
      && Information->DataLength == 4 )
    {
      v3 = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset);
      if( (unsigned int)(v3 - 1) > 3 )
        v3 = 2;
    }
    else
    {
      v3 = 2;
    }
    *(_DWORD *)(a1 + 1040) = v3;
    if( IopGetRegistryValue(Handle, (PWCHAR)L"MirrorSystemPartitionOnly", 4ui64, &Information) >= 0
      && Information->Type == 4
      && Information->DataLength == 4 )
    {
      *(_DWORD *)(a1 + 80) = *(_DWORD *)(a1 + 80) & 0xFFFFFFDF | (*(ULONG *)((char *)&Information->TitleIndex
                                                                           + Information->DataOffset) != 0 ? 0x20 : 0);
    }
    else
    {
      *(_DWORD *)(a1 + 80) &= ~0x20u;
    }
    if( IopGetRegistryValue(Handle, (PWCHAR)L"EnableInstrumentation", 4ui64, &Information) >= 0
      && Information->Type == 4
      && Information->DataLength == 4 )
    {
      *(_DWORD *)(a1 + 80) = *(_DWORD *)(a1 + 80) & 0xFFFFFF7F | (*(ULONG *)((char *)&Information->TitleIndex
                                                                           + Information->DataOffset) != 0 ? 0x80 : 0);
    }
    else
    {
      *(_DWORD *)(a1 + 80) &= ~0x80u;
    }
    if( IopGetRegistryValue(Handle, (PWCHAR)L"SkipDisablingInterrupts", 4ui64, &Information) >= 0
      && Information->Type == 4
      && Information->DataLength == 4 )
    {
      *(_DWORD *)(a1 + 80) = *(_DWORD *)(a1 + 80) & 0xFFFFFEFF | (*(ULONG *)((char *)&Information->TitleIndex
                                                                           + Information->DataOffset) != 0 ? 0x100 : 0);
    }
    else
    {
      *(_DWORD *)(a1 + 80) &= ~0x100u;
    }
    RegistryValue = IopGetRegistryValue(Handle, (PWCHAR)L"DumpFileSize", 4ui64, &Information);
    v2 = Information;
    if( RegistryValue >= 0 && Information->Type == 4 && Information->DataLength == 4 )
    {
      v5 = (unsigned __int64)*(unsigned int *)((char *)&Information->TitleIndex + Information->DataOffset) << 20;
      *(_DWORD *)(a1 + 80) |= 0x200u;
      *(_QWORD *)(a1 + 1048) = v5;
    }
    else
    {
      *(_DWORD *)(a1 + 80) &= ~0x200u;
    }
  }
  else
  {
    *(_DWORD *)(a1 + 80) &= 0xFFFFFC5F;
    *(_DWORD *)(a1 + 1040) = 2;
  }
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( v2 )
    ExFreePoolWithTag(v2, 0);
}

Referenced by: