NtDisableLastKnownGood

INT64 __fastcall NtDisableLastKnownGood(){
  int CachedContextBaseKey; 
  PVOID Data; 
  UINT64 DataSize; 
  struct _UNICODE_STRING ValueName; 
  int v5; 
  HANDLE KeyHandle; 
  PVOID BaseHandle; 
  v5 = 0;
  *(_DWORD *)(&ValueName.MaximumLength + 1) = 0;
  BaseHandle = 0i64;
  KeyHandle = 0i64;
  if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
  {
    if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, 1) )
    {
      CachedContextBaseKey = PnpCtxGetCachedContextBaseKey(PiPnpRtlCtx, 4, (__int64 *)&BaseHandle);
      if( CachedContextBaseKey >= 0 )
      {
        LODWORD(Data) = 0;
        ValueName.Buffer = (wchar_t *)L"Control\\Pnp";
        *(_DWORD *)&ValueName.Length = 1572886;
        CachedContextBaseKey = IopCreateRegistryKeyEx(
                                 &KeyHandle,
                                 BaseHandle,
                                 &ValueName,
                                 0xF003Fui64,
                                 (UINT64)Data,
                                 0i64);
        if( CachedContextBaseKey >= 0 )
        {
          ValueName.Buffer = (wchar_t *)L"DisableLKG";
          LODWORD(DataSize) = 4;
          v5 = 1;
          *(_DWORD *)&ValueName.Length = 1441812;
          CachedContextBaseKey = ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &v5, DataSize);
        }
        if( KeyHandle )
          ZwClose(KeyHandle);
      }
    }
    else
    {
      return(unsigned int)-1073741727;
    }
  }
  else
  {
    return(unsigned int)-1073741790;
  }
  return(unsigned int)CachedContextBaseKey;
}

Referenced by: