CmpRecordShutdownStopTime

__int64 __fastcall CmpRecordShutdownStopTime(__int64 a1, __int64 a2, __int64 a3, _LOOKASIDE_LIST_EX *a4){
  _PRIVILEGE_SET *v4; 
  wchar_t *a5; 
  wchar_t *v6; 
  int PersistedStateLocation; 
  WCHAR v8; 
  INT64 a6; 
  INT64 a6a; 
  INT64 a6b; 
  INT64 a6c; 
  INT64 a6d; 
  _LARGE_INTEGER PerformanceFrequency; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 DataSize; 
  VOID *KeyHandle; 
  VOID *v20; 
  UINT64 Data; 

  KeyHandle = 0i64;
  Data = 0i64;
  v4 = 0i64;
  PerformanceFrequency.QuadPart = 0i64;
  LODWORD(DataSize) = 0;
  v20 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  a5 = (wchar_t *)CmpAllocateTransientPoolWithTag(1ui64, 0x410ui64);
  v6 = a5;
  if( a5 )
  {
    LODWORD(a6) = 1040;
    PersistedStateLocation = RtlGetPersistedStateLocation(
                               (WCHAR *)L"ShutdownPath",
                               0i64,
                               L"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHUTDOWN",
                               0i64,
                               a5,
                               a6,
                               0i64);
    if( PersistedStateLocation >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, v6);
      LODWORD(a6a) = 0;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      ObjectAttributes.Attributes = 576;
      PersistedStateLocation = ZwCreateKey(&KeyHandle, 0x20006ui64, &ObjectAttributes, 0i64, 0i64, a6a, 0i64);
      if( PersistedStateLocation >= 0 )
      {
        Data = KeQueryPerformanceCounter(&PerformanceFrequency);
        RtlInitUnicodeString(&DestinationString, L"ShutdownStopTimePerfCounter");
        LODWORD(a6b) = 8;
        PersistedStateLocation = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 0xBui64, &Data, a6b);
        if( PersistedStateLocation >= 0 )
        {
          RtlInitUnicodeString(&DestinationString, L"LastBootPerfCounterFrequency");
          LODWORD(a6c) = 8;
          PersistedStateLocation = ZwSetValueKey(
                                     KeyHandle,
                                     &DestinationString,
                                     0i64,
                                     0xBui64,
                                     &PerformanceFrequency,
                                     a6c);
          if( PersistedStateLocation >= 0 )
          {
            PersistedStateLocation = CmpReadBuildLab(&v20, (unsigned int *)&DataSize, v8);
            if( PersistedStateLocation < 0 )
            {
              v4 = (_PRIVILEGE_SET *)v20;
            }
            else
            {
              RtlInitUnicodeString(&DestinationString, L"ShutdownStopTimePerfCounterBuildLab");
              v4 = (_PRIVILEGE_SET *)v20;
              LODWORD(a6d) = DataSize;
              PersistedStateLocation = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 1ui64, v20, a6d);
            }
          }
        }
      }
    }
    CmSiFreeMemory((PPRIVILEGE_SET)v6);
  }
  else
  {
    PersistedStateLocation = -1073741670;
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  if( v4 )
    CmSiFreeMemory(v4);
  return(unsigned int)PersistedStateLocation;
}

Referenced by: