LogFwpRegisterWorker

PWCHAR __stdcall LogFwpRegisterWorker(UINT64 MessageId){
  WCHAR v1; 
  PWCHAR result; 
  WCHAR v3; 
  NTSTATUS v4; 
  void *v5; 
  int v6; 
  WCHAR v7; 
  WCHAR v8; 
  WCHAR v9; 
  WCHAR v10; 
  WCHAR v11; 
  WCHAR v12; 
  WCHAR v13; 
  WCHAR v14; 
  WCHAR v15; 
  WCHAR v16; 
  WCHAR v17; 
  int *v18; 
  WCHAR v19; 
  WCHAR v20; 
  WCHAR v21; 
  WCHAR v22; 
  WCHAR v23; 
  WCHAR v24; 
  WCHAR v25; 
  WCHAR v26; 
  WCHAR v27; 
  WCHAR v28; 
  WCHAR v29; 
  WCHAR v30; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsc; 
  UINT64 CreateOptionsd; 
  UINT64 CreateOptionse; 
  UINT64 CreateOptionsf; 
  UINT64 CreateOptionsg; 
  UINT64 CreateOptionsh; 
  UINT64 CreateOptionsi; 
  UINT64 CreateOptionsj; 
  UINT64 CreateOptionsk; 
  UINT64 CreateOptionsb; 
  UINT64 CreateOptionsl; 
  UINT64 CreateOptionsm; 
  UINT64 CreateOptionsn; 
  UINT64 CreateOptionso; 
  UINT64 CreateOptionsp; 
  UINT64 CreateOptionsq; 
  UINT64 CreateOptionsr; 
  UINT64 CreateOptionss; 
  UINT64 CreateOptionst; 
  UINT64 CreateOptionsu; 
  UINT64 CreateOptionsv; 
  UINT64 CreateOptionsw; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int Data; 
  UINT64 Disposition; 
  HANDLE Handle; 
  LODWORD(Disposition) = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  Handle = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control", v1);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(result) = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( (int)result >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"BGFX", v3);
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    LODWORD(CreateOptions) = 1;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v4 = ZwCreateKey(&Handle, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, &Disposition);
    v5 = KeyHandle;
    if( v4 >= 0 )
    {
      v6 = dword_140CDAEFC;
      ZwClose(KeyHandle);
      RtlInitUnicodeString(&DestinationString, L"Resume", v7);
      Data = (v6 & 0x100000) != 0;
      LODWORD(CreateOptionsa) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsa);
      RtlInitUnicodeString(&DestinationString, L"Width", v8);
      Data = qword_140CDAF10;
      LODWORD(CreateOptionsc) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsc);
      RtlInitUnicodeString(&DestinationString, L"Height", v9);
      Data = HIDWORD(qword_140CDAF10);
      LODWORD(CreateOptionsd) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsd);
      RtlInitUnicodeString(&DestinationString, L"BPP", v10);
      Data = dword_140CDAEB8;
      LODWORD(CreateOptionse) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionse);
      RtlInitUnicodeString(&DestinationString, L"LogoSize", v11);
      Data = *(_DWORD *)Size;
      LODWORD(CreateOptionsf) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsf);
      RtlInitUnicodeString(&DestinationString, L"ProgressFrames", v12);
      Data = dword_140CDAEF8;
      LODWORD(CreateOptionsg) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsg);
      RtlInitUnicodeString(&DestinationString, L"ProgressMemory", v13);
      Data = dword_140C13330;
      LODWORD(CreateOptionsh) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsh);
      RtlInitUnicodeString(&DestinationString, L"ProgressProlog", v14);
      LODWORD(CreateOptionsi) = 4;
      Data = 1000000 * qword_140CDAF08 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsi);
      RtlInitUnicodeString(&DestinationString, L"ProgressLow", v15);
      LODWORD(CreateOptionsj) = 4;
      Data = 1000000 * qword_140C10FE8 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsj);
      RtlInitUnicodeString(&DestinationString, L"ProgressHigh", v16);
      LODWORD(CreateOptionsk) = 4;
      Data = 1000000 * qword_140CDAEC0 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsk);
      v18 = (int *)qword_140C13340;
      if( qword_140C13340 )
      {
        RtlInitUnicodeString(&DestinationString, L"ResidentSize", v17);
        Data = *v18;
        LODWORD(CreateOptionsb) = 4;
        ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsb);
      }
      RtlInitUnicodeString(&DestinationString, L"ProgressTotal", v17);
      LODWORD(CreateOptionsb) = 4;
      Data = 1000000 * qword_140CDAEE0 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsb);
      RtlInitUnicodeString(&DestinationString, L"ProgressManual", v19);
      LODWORD(CreateOptionsl) = 4;
      Data = 1000000 * qword_140CDAF00 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsl);
      RtlInitUnicodeString(&DestinationString, L"FadeProlog", v20);
      LODWORD(CreateOptionsm) = 4;
      Data = 1000000 * qword_140CDAF20 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsm);
      RtlInitUnicodeString(&DestinationString, L"FadeOverlap", v21);
      Data = dword_140CDAF38;
      LODWORD(CreateOptionsn) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsn);
      RtlInitUnicodeString(&DestinationString, L"FadeIo", v22);
      Data = dword_140CDAF28;
      LODWORD(CreateOptionso) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionso);
      RtlInitUnicodeString(&DestinationString, L"FadeCpu", v23);
      Data = dword_140CDAEB4;
      LODWORD(CreateOptionsp) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsp);
      RtlInitUnicodeString(&DestinationString, L"FadeFrames", v24);
      Data = dword_140CDAEB0;
      LODWORD(CreateOptionsq) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsq);
      RtlInitUnicodeString(&DestinationString, L"FadeMemory", v25);
      Data = dword_140C1332C;
      LODWORD(CreateOptionsr) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsr);
      RtlInitUnicodeString(&DestinationString, L"FadeLow", v26);
      LODWORD(CreateOptionss) = 4;
      Data = 1000000 * qword_140C10FF8 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionss);
      RtlInitUnicodeString(&DestinationString, L"FadeHigh", v27);
      LODWORD(CreateOptionst) = 4;
      Data = 1000000 * qword_140CDAED0 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionst);
      RtlInitUnicodeString(&DestinationString, L"FadeTotal", v28);
      LODWORD(CreateOptionsu) = 4;
      Data = 1000000 * qword_140CDAED8 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsu);
      RtlInitUnicodeString(&DestinationString, L"AnimationTotal", v29);
      Data = 1000000 * qword_140CDAEF0 / stru_140C10FF0.QuadPart;
      LODWORD(CreateOptionsv) = 4;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsv);
      RtlInitUnicodeString(&DestinationString, L"CompressBitmaps", v30);
      LODWORD(CreateOptionsw) = 4;
      Data = 1000000 * qword_140CF4D30 / stru_140C10FF0.QuadPart;
      ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsw);
      v5 = Handle;
    }
    LODWORD(result) = ZwClose(v5);
  }
  return result;
}

Referenced by: