MfgInitSystem

NTSTATUS __stdcall MfgInitSystem(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  int inited; 
  _LOADER_PARAMETER_EXTENSION *Extension; 
  unsigned __int16 Length; 
  VOID **PoolWithTag; 
  INT64 v6; 
  INT64 v7; 
  __int64 v8; 
  INT64 v9; 
  INT64 v10; 
  INT64 DataSize; 
  INT64 DataSizea; 
  UINT64 DataSizeb; 
  INT64 DataSizec; 
  UINT64 DataSized; 
  char *DataSizee; 
  UINT64 *Disposition; 
  UINT64 *Dispositiona; 
  UINT64 *Dispositionb; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING ValueName; 
  __int16 pszDest[256]; 

  Handle = 0i64;
  *(&ExBootDevicesRemovedEvent + 70) = 0i64;
  *(&ExBootDevicesRemovedEvent + 142) = 0i64;
  inited = 0;
  Extension = LoaderBlock->Extension;
  DestinationString = 0i64;
  v23 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyHandle = 0i64;
  ValueName = 0i64;
  Length = Extension->ManufacturingProfile.Length;
  if( !Length )
    return inited;
  if( Length >= 0x80u )
    return -1073741811;
  *(&ExBootDevicesRemovedEvent + 564) = Extension->ManufacturingProfile.Length;
  *(&ExBootDevicesRemovedEvent + 565) = Extension->ManufacturingProfile.MaximumLength;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, *(&ExBootDevicesRemovedEvent + 565), 1348953677i64);
  *(&ExBootDevicesRemovedEvent + 142) = PoolWithTag;
  if( PoolWithTag )
  {
    inited = RtlStringCbCopyW(
               (WCHAR *)PoolWithTag,
               *(&ExBootDevicesRemovedEvent + 565),
               Extension->ManufacturingProfile.Buffer);
    if( inited < 0 )
      goto LABEL_22;
    inited = RtlStringCbPrintfW((WCHAR *)pszDest, 0x200ui64, (WCHAR *)L"%s%s");
    if( inited < 0 )
      goto LABEL_22;
    inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)pszDest);
    if( inited < 0 )
      goto LABEL_22;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    inited = ZwOpenKey(
               &KeyHandle,
               0xF003Fui64,
               &ObjectAttributes,
               v6,
               (INT64)L"System\\CurrentControlSet\\Control\\ManufacturingMode\\",
               DataSize,
               (INT64)Disposition,
               v20);
    if( inited < 0 )
      goto LABEL_22;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)((char *)&ExBootDevicesRemovedEvent + 1128);
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    inited = ZwOpenKey(&Handle, 0xF003Fui64, &ObjectAttributes, v7, v9, DataSizea, (INT64)Dispositiona, v21);
    if( inited < 0 )
      goto LABEL_22;
    ZwClose((_HANDLE)Handle);
    *(&ExBootDevicesRemovedEvent + 280) |= 1u;
    RtlInitUnicodeStringEx(&ValueName, (WCHAR *)L"LastProfile");
    LODWORD(DataSizeb) = *(&ExBootDevicesRemovedEvent + 565);
    inited = ZwSetValueKey(KeyHandle, &ValueName, 0i64, 1ui64, *(&ExBootDevicesRemovedEvent + 142), DataSizeb);
    if( inited < 0 )
      goto LABEL_22;
    inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"Current");
    if( inited < 0 )
      goto LABEL_22;
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 832;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKeyEx((VOID **)&v23, 0xF003Fui64, &ObjectAttributes, 8ui64, v10, DataSizec, (INT64)Dispositionb, v22) >= 0 )
    {
      inited = ZwDeleteKey((VOID *)v23);
      if( inited < 0 )
        goto LABEL_22;
      ZwClose(v23);
      v23 = 0i64;
    }
    LODWORD(DataSized) = 3;
    inited = ZwCreateKey((VOID **)&v23, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, DataSized, 0i64);
    if( inited >= 0 )
    {
      DataSizee = (char *)&ExBootDevicesRemovedEvent + 1128;
      inited = RtlStringCbPrintfW((WCHAR *)pszDest, 0x200ui64, (WCHAR *)L"%s%s%wZ");
      if( inited >= 0 )
      {
        v8 = -1i64;
        do
          ++v8;
        while( pszDest[v8] );
        LODWORD(DataSizee) = 2 * v8;
        inited = ZwSetValueKey((VOID *)v23, &CmSymbolicLinkValueName, 0i64, 6ui64, pszDest, (UINT64)DataSizee);
      }
    }
    goto LABEL_22;
  }
  inited = -1073741670;
LABEL_22:
  if( v23 )
    ZwClose(v23);
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return inited;
}

Referenced by: