KeCommitSmtState

NTSTATUS __stdcall KeCommitSmtState(){
  INT64 v0; 
  NTSTATUS result; 
  int v2; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  INT64 Data; 
  VOID *KeyHandle; 
  UINT64 v9; 
  _UNICODE_STRING ValueName; 
  __int64 v11[2]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v14; 

  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  LODWORD(v9) = 0;
  LODWORD(Data) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  v14 = 0;
  v11[1] = (__int64)L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management";
  ValueName.Buffer = L"FeatureSettings";
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v11;
  KeyValueInformation = 0i64;
  v11[0] = 11141288i64;
  *(_QWORD *)&ValueName.Length = 2097182i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  result = ZwOpenKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, v0, Length, (INT64)ResultLength, Data, 0i64);
  if( result < 0 )
    goto LABEL_7;
  LODWORD(Lengtha) = 20;
  result = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v9);
  if( result == -1073741772 )
  {
    v2 = 0;
  }
  else
  {
    if( result < 0 || *(_QWORD *)((char *)&KeyValueInformation + 4) != 0x400000004i64 )
      goto LABEL_7;
    v2 = HIDWORD(KeyValueInformation);
  }
  LODWORD(ResultLengtha) = 4;
  LODWORD(Data) = v2 ^ (v2 ^ KiFeatureSettings) & 0x1C0000;
  result = ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &Data, (UINT64)ResultLengtha);
LABEL_7:
  if( KeyHandle )
    return ZwClose((_HANDLE)KeyHandle);
  return result;
}

Referenced by: