PopDetectSimulatedHeteroProcessors

char __fastcall PopDetectSimulatedHeteroProcessors(__int64 a1){
  WCHAR v1; 
  char v2; 
  WCHAR v3; 
  unsigned int v5; 
  void *v6; 
  NTSTATUS v7; 
  unsigned __int16 v8; 
  __int64 v9; 
  __int64 v10; 
  int ActiveProcessorCount; 
  int *v12; 
  _BYTE *v13; 
  __int64 v14; 
  unsigned int v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  UINT64 Length; 
  UINT64 ResultLength; 
  void *KeyHandle; 
  HANDLE Handle; 
  UNICODE_STRING String; 
  __int64 v23; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING ValueName; 
  __int128 KeyValueInformation; 
  __int128 KeyInformation; 
  __int64 v29; 
  int v30; 
  INT64 result; 
  _QWORD result_4[21]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ResultLength = 0i64;
  KeyHandle = 0i64;
  v23 = a1;
  KeyInformation = 0i64;
  v29 = 0i64;
  DestinationString = 0i64;
  memset((INT64)result_4, 0i64);
  Handle = 0i64;
  v30 = 1310721;
  String = 0i64;
  KeyValueInformation = 0i64;
  ValueName = 0i64;
  memset((INT64)&result, 0i64);
  RtlInitUnicodeString(
    &DestinationString,
    L"\\Registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Kernel\\KGroups",
    v1);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  v2 = 0;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 8u, &ObjectAttributes) < 0 )
    return v2;
  v5 = 0;
  String.Buffer = (wchar_t *)&v29;
  String.MaximumLength = 4;
  RtlInitUnicodeString(&ValueName, L"SmallProcessorMask", v3);
  v6 = KeyHandle;
  ObjectAttributes.RootDirectory = KeyHandle;
  do
  {
    LODWORD(Length) = 24;
    v7 = ZwEnumerateKey(v6, v5, KeyBasicInformation, &KeyInformation, Length, &ResultLength);
    if( v7 < 0 )
      goto LABEL_20;
    LODWORD(ResultLength) = HIDWORD(KeyInformation);
    if( HIDWORD(KeyInformation) <= 4 )
    {
      String.Length = WORD6(KeyInformation);
      v7 = RtlUnicodeStringToInteger(&String, 0xAui64, (UINT64 *)((char *)&ResultLength + 4));
      if( v7 >= 0 )
      {
        v8 = WORD2(ResultLength);
        if( HIDWORD(ResultLength) < HIWORD(v30) )
        {
          DestinationString = String;
          v7 = ZwOpenKey(&Handle, 1u, &ObjectAttributes);
          if( v7 < 0 )
          {
LABEL_20:
            ++v5;
            goto LABEL_21;
          }
          v7 = ZwQueryValueKey(
                 Handle,
                 &ValueName,
                 KeyValuePartialInformationAlign64,
                 &KeyValueInformation,
                 0x10u,
                 (PULONG)&ResultLength);
          if( v7 >= 0 && ((_DWORD)KeyValueInformation == 4 || (_DWORD)KeyValueInformation == 11) )
          {
            v2 = 1;
            if( DWORD1(KeyValueInformation) == 4 )
            {
              v9 = DWORD2(KeyValueInformation);
              *((_QWORD *)&KeyValueInformation + 1) = DWORD2(KeyValueInformation);
LABEL_16:
              if( (unsigned __int16)v30 <= v8 )
                LOWORD(v30) = v8 + 1;
              result_4[v8] |= v9;
              goto LABEL_19;
            }
            if( DWORD1(KeyValueInformation) == 8 )
            {
              v9 = *((_QWORD *)&KeyValueInformation + 1);
              goto LABEL_16;
            }
          }
LABEL_19:
          ZwClose(Handle);
          goto LABEL_20;
        }
      }
    }
LABEL_21:
    v6 = KeyHandle;
  }
  while( v7 >= 0 );
  ZwClose(KeyHandle);
  v10 = v23;
  if( v2 )
  {
    ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
    v12 = KiProcessorIndexToNumberMappingTable;
    v13 = (_BYTE *)(v10 + 8);
    v14 = (unsigned int)(ActiveProcessorCount + 1);
    do
    {
      v15 = *v12++;
      v16 = v15;
      LOBYTE(v15) = v15 & 0x3F;
      v16 >>= 6;
      v17 = (result_4[v16] >> v15) & 1i64;
      LOBYTE(v15) = !((result_4[v16] >> v15) & 1);
      *v13 = v15;
      *(v13 - 1) = v17;
      *(v13 - 2) = v15;
      v13 += 3;
      --v14;
    }
    while( v14 );
    *(_WORD *)(v10 + 4) = 257;
  }
  return v2;
}

Referenced by: