sub_14094DC8C

INT64 __fastcall sub_14094DC8C(INT64 a1){
  INT64 *v2; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  _ETHREAD *CurrentThread; 
  char v7; 
  NTSTATUS v8; 
  void *KeyHandle; 
  v8 = 0;
  KeyHandle = 0i64;
  v7 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v2 = (INT64 *)(a1 + 46840);
  ExAcquirePushLockSharedEx(a1 + 46840, 0i64);
  if( *(_QWORD *)(a1 + 46832) )
  {
    LODWORD(CreateOptions) = 0;
    v8 = ZwCreateKey(&KeyHandle, 0x20006ui64, (OBJECT_ATTRIBUTES *)&stru_140984900, 0i64, 0i64, CreateOptions, 0i64);
    if( v8 >= 0 )
    {
      v7 = 1;
      LODWORD(CreateOptionsa) = **(_DWORD **)(a1 + 46832);
      v8 = ZwSetValueKey(
             KeyHandle,
             (UNICODE_STRING *)&stru_1409841B8,
             0i64,
             3ui64,
             *(PVOID *)(a1 + 46832),
             CreateOptionsa);
    }
  }
  if( _InterlockedCompareExchange64(v2, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v2);
  KeAbPostRelease(v2);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v7 == 1 )
    ZwClose(KeyHandle);
  return(unsigned int)v8;
}

Referenced by: