IoSetSystemPartition

INT64 __stdcall IoSetSystemPartition(PUNICODE_STRING VolumeNameString){
  WCHAR v1; 
  HANDLE v3; 
  NTSTATUS v4; 
  NTSTATUS v5; 
  int v6; 
  PVOID Data; 
  wchar_t *Dataa; 
  UINT64 DataSize; 
  HANDLE Handle; 
  void *KeyHandle; 
  struct _UNICODE_STRING ValueName; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v16; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  int v21; 
  int v22; 
  int v23; 
  v3 = 0i64;
  Handle = 0i64;
  ValueName = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\REGISTRY\\MACHINE\\SYSTEM", v1);
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  KeyHandle = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(&KeyHandle, 0xF003Fu, &ObjectAttributes);
  if( v4 >= 0 )
  {
    ValueName.Buffer = (wchar_t *)&v16;
    v16 = 6619219;
    v17 = 7667828;
    v18 = 112;
    *(_DWORD *)&ValueName.Length = 786442;
    LODWORD(Data) = 0;
    v5 = IopCreateRegistryKeyEx(&Handle, KeyHandle, &ValueName, 0xF003Fui64, (UINT64)Data, 0i64);
    v3 = Handle;
    v4 = v5;
    if( v5 >= 0 )
    {
      v6 = VolumeNameString->Length + 2;
      v16 = 7929939;
      LODWORD(DataSize) = v6;
      Dataa = VolumeNameString->Buffer;
      v17 = 7602291;
      v18 = 7143525;
      v19 = 6357072;
      v20 = 7602290;
      v21 = 7602281;
      v22 = 7274601;
      v23 = 110;
      *(_DWORD *)&ValueName.Length = 2097182;
      v4 = ZwSetValueKey(Handle, &ValueName, 0i64, 1ui64, Dataa, DataSize);
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( v3 )
    ZwClose(v3);
  return(unsigned int)v4;
}

Referenced by: