PspReadDfssConfigurationValues

VOID __stdcall PspReadDfssConfigurationValues(){
  INT64 v0; 
  NTSTATUS v1; 
  WCHAR **v2; 
  __int64 v3; 
  NTSTATUS ImageFileKeyOption; 
  CHAR v5; 
  WCHAR *v6; 
  PIO_APC_ROUTINE v7; 
  _HANDLE v8; 
  UINT64 BufferSize; 
  UINT64 *ResultSize; 
  INT64 Asynchroneous; 
  PVOID ChangeBuffer; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 

  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( *(_QWORD *)&PspDfssConfigurationKey )
  {
    v1 = 0;
    KeyHandle = *(VOID **)&PspDfssConfigurationKey;
  }
  else
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)PspQuotaKeyNames;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v1 = ZwOpenKey(
           &KeyHandle,
           0x11ui64,
           &ObjectAttributes,
           v0,
           BufferSize,
           (INT64)ResultSize,
           Asynchroneous,
           (INT64)ChangeBuffer);
  }
  if( v1 >= 0 )
  {
    v2 = (WCHAR **)&PspDfssConfigValues;
    v3 = 4i64;
    do
    {
      LODWORD(BufferSize) = 4;
      ImageFileKeyOption = RtlQueryImageFileKeyOption(KeyHandle, v2[1], 4ui64, *v2, BufferSize, 0i64);
      v6 = *v2;
      if( ImageFileKeyOption >= 0 )
      {
        if( !*(_DWORD *)v6 )
          *(_DWORD *)v6 = 1;
      }
      else
      {
        *(_DWORD *)v6 = *((_DWORD *)v2 + 4);
      }
      v2 += 3;
      --v3;
    }
    while( v3 );
    if( PspDfssConfigurationNotify )
    {
      KeUpdateGroupSchedulingConstants(0i64, v5);
    }
    else
    {
      PspDfssConfigurationNotify = (PIO_APC_ROUTINE)ExAllocatePoolWithTag(0x200ui64, 0x30ui64, 1936942660i64);
      if( !PspDfssConfigurationNotify )
      {
        ZwClose((_HANDLE)KeyHandle);
        return;
      }
      *(_QWORD *)&PspDfssConfigurationKey = KeyHandle;
    }
    v7 = PspDfssConfigurationNotify;
    v8 = PspDfssConfigurationKey;
    *((_QWORD *)PspDfssConfigurationNotify + 2) = PspDfssConfigurationChangeHandler;
    *((_QWORD *)v7 + 3) = 0i64;
    *(_QWORD *)v7 = 0i64;
    if( ZwNotifyChangeKey(v8, 0, v7, (PVOID)1, (PIO_STATUS_BLOCK)v7 + 2, 4u, 0, 0i64, 0, 1u) < 0 )
    {
      ZwClose(PspDfssConfigurationKey);
      *(_QWORD *)&PspDfssConfigurationKey = 0i64;
      ExFreePoolWithTag(PspDfssConfigurationNotify, 0x73736644u);
      PspDfssConfigurationNotify = 0i64;
    }
  }
}

Referenced by: