PspIsDfssEnabled

UINT8 __stdcall PspIsDfssEnabled(){
  INT64 v0; 
  UINT8 v1; 
  unsigned int v2; 
  VOID *v3; 
  NTSTATUS inited; 
  __int128 *p_KeyValueInformation; 
  NTSTATUS v6; 
  void *v7; 
  int v8; 
  VOID *PoolWithQuotaTag; 
  NTSTATUS v10; 
  int v11; 
  size_t v13; 
  UINT64 Length; 
  UINT64 *ResultLength; 
  UINT64 NumberOfBytes[2]; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v21; 

  HIDWORD(NumberOfBytes[0]) = 0;
  v1 = 0;
  KeyHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v2 = 0;
  while( 1 )
  {
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&PspQuotaKeyNames[2 * v2];
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(
           &KeyHandle,
           1ui64,
           &ObjectAttributes,
           v0,
           Length,
           (INT64)ResultLength,
           NumberOfBytes[0],
           NumberOfBytes[1]) < 0 )
    {
LABEL_16:
      if( !v1 )
        return v1;
LABEL_22:
      PspReadDfssConfigurationValues();
      return v1;
    }
    v3 = KeyHandle;
    LODWORD(NumberOfBytes[0]) = 0;
    v21 = 0;
    DestinationString = 0i64;
    KeyValueInformation = 0i64;
    inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)L"EnableCpuQuota");
    if( inited >= 0 )
    {
      LODWORD(Length) = 20;
      p_KeyValueInformation = &KeyValueInformation;
      v6 = ZwQueryValueKey(
             v3,
             &DestinationString,
             KeyValuePartialInformation,
             &KeyValueInformation,
             Length,
             NumberOfBytes);
      inited = v6;
      if( v6 >= 0 )
      {
        v7 = 0i64;
LABEL_8:
        v11 = *((_DWORD *)p_KeyValueInformation + 1);
        if( ((v11 - 3) & 0xFFFFFFFB) != 0 )
        {
          if( v11 != 4 )
          {
            if( v11 != 11 && v11 == 1 )
            {
              if( (((unsigned __int8)NumberOfBytes + 4) & 3) != 0 )
              {
                inited = -2147483646;
              }
              else
              {
                LODWORD(NumberOfBytes[0]) = 4;
                DestinationString.Buffer = (wchar_t *)p_KeyValueInformation + 6;
                DestinationString.Length = *((_WORD *)p_KeyValueInformation + 4);
                DestinationString.MaximumLength = *((_WORD *)p_KeyValueInformation + 4);
                inited = RtlUnicodeStringToInteger(&DestinationString, 0i64, (UINT64 *)((char *)NumberOfBytes + 4));
              }
              goto LABEL_12;
            }
LABEL_11:
            inited = -1073741788;
            goto LABEL_12;
          }
          if( *((_DWORD *)p_KeyValueInformation + 2) == 4 )
          {
            LODWORD(NumberOfBytes[0]) = 4;
            HIDWORD(NumberOfBytes[0]) = *((_DWORD *)p_KeyValueInformation + 3);
          }
          else
          {
            inited = -1073741820;
          }
        }
        else
        {
          if( v11 != 4 )
            goto LABEL_11;
          LODWORD(NumberOfBytes[0]) = *((_DWORD *)p_KeyValueInformation + 2);
          v13 = *((_DWORD *)p_KeyValueInformation + 2);
          if( v13 > 4 )
            inited = -2147483643;
          else
            memmove((char *)NumberOfBytes + 4, (char *)p_KeyValueInformation + 12, v13);
        }
LABEL_12:
        if( v7 )
          ExFreePoolWithTag(v7, 0);
        goto LABEL_15;
      }
      if( v6 == -2147483643 )
      {
        while( 1 )
        {
          v8 = NumberOfBytes[0];
          PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, LODWORD(NumberOfBytes[0]), 0x6B497452ui64);
          v7 = PoolWithQuotaTag;
          if( !PoolWithQuotaTag )
            break;
          p_KeyValueInformation = (__int128 *)PoolWithQuotaTag;
          LODWORD(Length) = v8;
          v10 = ZwQueryValueKey(
                  v3,
                  &DestinationString,
                  KeyValuePartialInformation,
                  PoolWithQuotaTag,
                  Length,
                  NumberOfBytes);
          inited = v10;
          if( v10 >= 0 )
            goto LABEL_8;
          if( v10 != -2147483643 )
            goto LABEL_12;
          ExFreePoolWithTag(v7, 0);
        }
        inited = -1073741801;
      }
    }
LABEL_15:
    ZwClose((_HANDLE)KeyHandle);
    if( inited < 0 )
      goto LABEL_16;
    if( !HIDWORD(NumberOfBytes[0]) )
      return 0;
    ++v2;
    v1 = 1;
    if( v2 >= 2 )
      goto LABEL_22;
  }
}

Referenced by: