PsBootPhaseComplete

INT64 __fastcall PsBootPhaseComplete(WCHAR *a1){
  _BOOL8 v1; 
  WCHAR *v2; 
  char v3; 
  NTSTATUS v4; 
  void *v5; 
  unsigned int *v6; 
  int v7; 
  unsigned int v8; 
  NTSTATUS v9; 
  __int64 v10; 
  __int64 *ServerSiloGlobals; 
  INT64 result; 
  void *KeyHandle; 
  ULONG ResultLength[2]; 
  __int64 v15[2]; 
  struct _UNICODE_STRING ValueName; 
  __int64 v17[2]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v20[2]; 
  const wchar_t *v21; 
  int v22[4]; 
  const wchar_t *v23; 
  int v24; 
  int v25; 
  const wchar_t *v26; 
  int v27; 
  v15[0] = 8650882i64;
  ResultLength[0] = 0;
  v15[1] = (__int64)L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\LsaInformation";
  KeyHandle = 0i64;
  ValueName.Buffer = L"UACInstalled";
  *(_QWORD *)&ValueName.Length = 1703960i64;
  v17[1] = (__int64)L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System";
  *(&ObjectAttributes.Length + 1) = 0;
  v21 = L"EnableLUA";
  *(&ObjectAttributes.Attributes + 1) = 0;
  v23 = L"EnableVirtualization";
  v17[0] = 9961622i64;
  v26 = L"EnableInstallerDetection";
  KeyValueInformation = 0i64;
  v20[0] = 1310738;
  v22[0] = 1;
  v22[2] = 2752552;
  v24 = 2;
  v25 = 3276848;
  v27 = 3;
  ResultLength[1] = 0;
  if( (int)RtlQueryImageFileExecutionOptions(a1, L"DevOverrideEnable") >= 0 )
  {
    v1 = ResultLength[0] != 0;
    PspGlobalFlags = v1 | PspGlobalFlags & 0xFFFFFFFE;
  }
  RtlQueryImageFileExecutionOptions((WCHAR *)v1, L"MaxLoaderThreads");
  RtlQueryImageFileExecutionOptions(v2, L"NoRemoteThreadBeforeProcessInit");
  v3 = 0;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v15;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes) >= 0 )
  {
    if( ZwQueryValueKey(
           KeyHandle,
           &ValueName,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x10u,
           &ResultLength[1]) >= 0
      && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64
      && HIDWORD(KeyValueInformation) )
    {
      v3 = 1;
    }
    ObCloseHandle(KeyHandle, 0);
    KeyHandle = 0i64;
    if( v3 )
    {
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)v17;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v4 = ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes);
      v5 = KeyHandle;
      v6 = (unsigned int *)v22;
      v7 = v4;
      v8 = 0;
      if( v4 < 0 )
        v5 = 0i64;
      KeyHandle = v5;
      do
      {
        if( v5 )
        {
          v9 = ZwQueryValueKey(
                 v5,
                 (PUNICODE_STRING)&v20[6 * v8],
                 KeyValuePartialInformation,
                 &KeyValueInformation,
                 0x10u,
                 &ResultLength[1]);
          v5 = KeyHandle;
          v7 = v9;
        }
        if( v7 < 0 || HIDWORD(KeyValueInformation) || *(_QWORD *)((char *)&KeyValueInformation + 4) != 0x400000004i64 )
        {
          _interlockedbittestandset((volatile signed __int32 *)&KUSER_SHARED_DATA.SharedDataFlags, *v6);
          v5 = KeyHandle;
        }
        ++v8;
        v6 += 6;
      }
      while( v8 < 3 );
      if( v5 )
        ObCloseHandle(v5, 0);
    }
  }
  PsCpuFairShareEnabled = PspIsDfssEnabled();
  v10 = HalSystemVectorDispatchEntry();
  ServerSiloGlobals = PsGetServerSiloGlobals(v10);
  *((_BYTE *)ServerSiloGlobals + 1048) = PspQueryForwardersEnabled();
  result = PspGlobalFlags & 0xFFFFFFF3 | 4;
  PspGlobalFlags = PspGlobalFlags & 0xFFFFFFF3 | 4;
  return result;
}

Referenced by: