SepSecureBootCheckForUpdates
VOID __stdcall SepSecureBootCheckForUpdates(){
INT64 v0;
INT64 Length;
UINT64 Lengtha;
UINT64 *ResultLength;
UINT64 *ResultLengtha;
INT64 v5;
UINT64 v6;
INT64 v7;
UINT64 MatchingChangeStamp;
VOID *KeyHandle;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int128 KeyValueInformation;
int v12;
KeyHandle = 0i64;
LODWORD(MatchingChangeStamp) = 0;
ObjectAttributes.Length = 48;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ObjectAttributes.RootDirectory = 0i64;
v12 = 0;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"z|";
KeyValueInformation = 0i64;
ObjectAttributes.Attributes = 576;
if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v0, Length, (INT64)ResultLength, v5, v7) >= 0 )
{
LODWORD(Lengtha) = 20;
if( ZwQueryValueKey(
KeyHandle,
(_UNICODE_STRING *)&stru_140009780 + 2,
KeyValuePartialInformation,
&KeyValueInformation,
Lengtha,
&MatchingChangeStamp) >= 0
&& *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64
&& HIDWORD(KeyValueInformation) )
{
LODWORD(v6) = 0;
LODWORD(ResultLengtha) = 0;
NtUpdateWnfStateData(&WNF_SBS_UPDATE_AVAILABLE, 0i64, 0i64, 0i64, 0i64, (UINT64)ResultLengtha, v6);
}
}
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
}Referenced by:
SeSecureBootRegisterPolicy