PopThermalHandlePreviousShutdown

INT64 __stdcall PopThermalHandlePreviousShutdown(){
  WCHAR v0; 
  INT64 result; 
  WCHAR v2; 
  WCHAR v3; 
  WCHAR v4; 
  HANDLE v5; 
  char v6; 
  WCHAR *v7; 
  WCHAR *v8; 
  int v9; 
  WCHAR *PoolWithTag; 
  WCHAR v11; 
  HANDLE v12; 
  PULONG ResultLength; 
  PULONG ResultLengtha; 
  ULONG Length; 
  int Data; 
  HANDLE KeyHandle; 
  HANDLE Handle; 
  UNICODE_STRING v19; 
  struct _UNICODE_STRING ValueName; 
  struct _UNICODE_STRING DestinationString; 
  __int128 KeyValueInformation; 
  int v23; 
  struct _EVENT_DATA_DESCRIPTOR v24; 
  char v25[16]; 
  HANDLE *p_KeyHandle; 
  int v27; 
  int v28; 
  KeyHandle = 0i64;
  Length = 0;
  Data = 0;
  Handle = 0i64;
  DestinationString = 0i64;
  v19 = 0i64;
  ValueName = 0i64;
  result = PopOpenThermalLoggingKey(0, &KeyHandle, v0);
  if( (int)result >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"ShutdownOccurred", v2);
    RtlInitUnicodeString(&v19, L"ShutdownSource", v3);
    RtlInitUnicodeString(&ValueName, L"ShutdownTemperature", v4);
    v5 = KeyHandle;
    v23 = 0;
    KeyValueInformation = 0i64;
    LODWORD(result) = ZwQueryValueKey(
                        KeyHandle,
                        &DestinationString,
                        KeyValuePartialInformation,
                        &KeyValueInformation,
                        0x14u,
                        &Length);
    if( (int)result >= 0 && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
    {
      if( ZwQueryValueKey(v5, &ValueName, KeyValuePartialInformation, &KeyValueInformation, 0x14u, &Length) >= 0
        && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
      {
        v6 = 1;
        Data = HIDWORD(KeyValueInformation);
      }
      else
      {
        v6 = 0;
      }
      v7 = 0i64;
      v8 = (WCHAR *)L"Unknown";
      v9 = 16;
      if( ZwQueryValueKey(v5, &v19, KeyValuePartialInformation, 0i64, 0, &Length) == -1073741789 )
      {
        PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, Length + 2i64, 0x6D726854ui64);
        v7 = PoolWithTag;
        if( PoolWithTag )
        {
          memset((INT64)PoolWithTag, 0i64);
          if( ZwQueryValueKey(v5, &v19, KeyValuePartialInformation, v7, Length, &Length) >= 0
            && *((_DWORD *)v7 + 1) == 1 )
          {
            v9 = *((_DWORD *)v7 + 2);
            v8 = v7 + 6;
          }
        }
      }
      LODWORD(result) = ZwDeleteValueKey(v5, &DestinationString);
      if( (int)result >= 0 )
      {
        if( (int)PopOpenThermalLoggingKey(1, &Handle, v11) >= 0 )
        {
          LODWORD(ResultLength) = v9;
          v12 = Handle;
          ZwSetValueKey(Handle, &v19, 0i64, 1ui64, v8, (UINT64)ResultLength);
          if( v6 )
          {
            LODWORD(ResultLengtha) = 4;
            ZwSetValueKey(v12, &ValueName, 0i64, 4ui64, &Data, (UINT64)ResultLengtha);
          }
          ZwClose(v12);
        }
        ZwUpdateWnfStateData();
        if( (unsigned int)dword_140C021E8 > 5 && tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64) )
        {
          tlgCreate1Sz_wchar_t((__int64)v25, v8);
          v28 = 0;
          p_KeyHandle = &KeyHandle;
          LODWORD(KeyHandle) = Data;
          v27 = 4;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&dword_140C021E8,
            (unsigned __int8 *)&dword_1400260C4,
            0i64,
            0i64,
            4u,
            &v24);
        }
        ZwDeleteValueKey(v5, &ValueName);
        LODWORD(result) = ZwDeleteValueKey(v5, &v19);
      }
      if( v7 )
        ExFreePoolWithTag(v7, 0x6D726854u);
    }
    if( v5 )
      LODWORD(result) = ZwClose(v5);
  }
  return result;
}

Referenced by: