PopDetectSimulatedHeteroProcessors

UINT8 __stdcall PopDetectSimulatedHeteroProcessors(_KAFFINITY_EX *SmallProcessors){
  UINT8 v1; 
  INT64 v2; 
  unsigned int v4; 
  VOID *v5; 
  NTSTATUS v6; 
  INT64 v7; 
  unsigned __int16 v8; 
  __int64 v9; 
  __int64 v10; 
  int ActiveProcessorCount; 
  int *v12; 
  _BYTE *v13; 
  __int64 v14; 
  unsigned int v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  UINT64 Value; 
  VOID *KeyHandle; 
  VOID *Handle; 
  _UNICODE_STRING String; 
  _KAFFINITY_EX *v26; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _UNICODE_STRING ValueName; 
  __int128 KeyValueInformation; 
  __int128 KeyInformation; 
  __int64 v32; 
  int v33; 
  _DWORD v34[43]; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v26 = SmallProcessors;
  KeyInformation = 0i64;
  v32 = 0i64;
  DestinationString = 0i64;
  Handle = 0i64;
  v33 = 1310721;
  String = 0i64;
  KeyValueInformation = 0i64;
  ValueName = 0i64;
  memset(v34, 0i64, 0xA4u);
  RtlInitUnicodeString(
    &DestinationString,
    L"\\Registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Kernel\\KGroups");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  v1 = 0;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 8ui64, &ObjectAttributes, v2, Length, (INT64)ResultLength, 0i64, 0i64) < 0 )
    return v1;
  v4 = 0;
  String.Buffer = (wchar_t *)&v32;
  String.MaximumLength = 4;
  RtlInitUnicodeString(&ValueName, L"SmallProcessorMask");
  v5 = KeyHandle;
  ObjectAttributes.RootDirectory = KeyHandle;
  do
  {
    LODWORD(Lengtha) = 24;
    v6 = ZwEnumerateKey(v5, v4, KeyBasicInformation, &KeyInformation, Lengtha, &Value);
    if( v6 < 0 )
      goto LABEL_20;
    LODWORD(Value) = HIDWORD(KeyInformation);
    if( HIDWORD(KeyInformation) <= 4 )
    {
      String.Length = WORD6(KeyInformation);
      v6 = RtlUnicodeStringToInteger(&String, 0xAui64, (UINT64 *)((char *)&Value + 4));
      if( v6 >= 0 )
      {
        v8 = WORD2(Value);
        if( HIDWORD(Value) < HIWORD(v33) )
        {
          DestinationString = String;
          v6 = ZwOpenKey(&Handle, 1ui64, &ObjectAttributes, v7, Lengtha, (INT64)ResultLengtha, Value, (INT64)KeyHandle);
          if( v6 < 0 )
          {
LABEL_20:
            ++v4;
            goto LABEL_21;
          }
          LODWORD(Lengtha) = 16;
          v6 = ZwQueryValueKey(
                 Handle,
                 &ValueName,
                 KeyValuePartialInformationAlign64,
                 &KeyValueInformation,
                 Lengtha,
                 &Value);
          if( v6 >= 0 && ((_DWORD)KeyValueInformation == 4 || (_DWORD)KeyValueInformation == 11) )
          {
            v1 = 1;
            if( DWORD1(KeyValueInformation) == 4 )
            {
              v9 = DWORD2(KeyValueInformation);
              *((_QWORD *)&KeyValueInformation + 1) = DWORD2(KeyValueInformation);
LABEL_16:
              if( (unsigned __int16)v33 <= v8 )
                LOWORD(v33) = v8 + 1;
              *(_QWORD *)&v34[2 * v8 + 1] |= v9;
              goto LABEL_19;
            }
            if( DWORD1(KeyValueInformation) == 8 )
            {
              v9 = *((_QWORD *)&KeyValueInformation + 1);
              goto LABEL_16;
            }
          }
LABEL_19:
          ZwClose((_HANDLE)Handle);
          goto LABEL_20;
        }
      }
    }
LABEL_21:
    v5 = KeyHandle;
  }
  while( v6 >= 0 );
  ZwClose((_HANDLE)KeyHandle);
  v10 = (__int64)v26;
  if( v1 )
  {
    ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
    v12 = KiProcessorIndexToNumberMappingTable;
    v13 = (_BYTE *)(v10 + 8);
    v14 = (unsigned int)(ActiveProcessorCount + 1);
    do
    {
      v15 = *v12++;
      v16 = v15;
      LOBYTE(v15) = v15 & 0x3F;
      v16 >>= 6;
      v17 = (*(_QWORD *)&v34[2 * v16 + 1] >> v15) & 1i64;
      LOBYTE(v15) = !((*(_QWORD *)&v34[2 * v16 + 1] >> v15) & 1);
      *v13 = v15;
      *(v13 - 1) = v17;
      *(v13 - 2) = v15;
      v13 += 3;
      --v14;
    }
    while( v14 );
    *(_WORD *)(v10 + 4) = 257;
  }
  return v1;
}

Referenced by: