CmpCreateControlSet

NTSTATUS __stdcall CmpCreateControlSet(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  char v1; 
  char v2; 
  int v4; 
  int ValueKey; 
  NTSTATUS v6; 
  PULONG ResultLength; 
  PULONG ResultLengtha; 
  PULONG ResultLengthb; 
  PULONG ResultLengthc; 
  unsigned int Data; 
  ULONG Disposition; 
  struct _UNICODE_STRING DestinationString; 
  HANDLE Handle; 
  HANDLE v16; 
  void *KeyHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v19[4]; 
  int KeyValueInformation[32]; 
  char v21[256]; 
  *(_QWORD *)&DestinationString.Length = 0x1000000i64;
  v19[0] = 0;
  v2 = v1;
  Disposition = 0;
  DestinationString.Buffer = (wchar_t *)v21;
  KeyHandle = 0i64;
  v16 = 0i64;
  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Data = 0;
  RtlUnicodeStringPrintf(&DestinationString, L"\\Registry\\Machine\\%ws", LoaderBlock);
  ValueKey = v4;
  if( v4 >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    ValueKey = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
    if( ValueKey >= 0 )
    {
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&CmpSelectString;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v6 = ZwOpenKey(&v16, 0x20019u, &ObjectAttributes);
      ValueKey = v6;
      if( v6 == -1073741772 )
      {
        if( !v2 )
          goto LABEL_10;
        LODWORD(ResultLength) = 0;
        ValueKey = ZwCreateKey(
                     &v16,
                     0x20019ui64,
                     &ObjectAttributes,
                     0i64,
                     0i64,
                     (UINT64)ResultLength,
                     (UINT64 *)&Disposition);
        if( ValueKey < 0 )
          goto LABEL_10;
        Data = 1;
        LODWORD(ResultLengthb) = 4;
        ValueKey = ZwSetValueKey(v16, (UNICODE_STRING *)&CmpCurrentString, 0i64, 4ui64, &Data, (UINT64)ResultLengthb);
        if( ValueKey < 0 )
          goto LABEL_10;
        *(_QWORD *)&DestinationString.Length = 0x1000000i64;
        DestinationString.Buffer = (wchar_t *)v21;
        RtlUnicodeStringPrintf(&DestinationString, L"ControlSet%03d", Data);
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Attributes = 576;
        LODWORD(ResultLengthc) = 0;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        ValueKey = ZwCreateKey(
                     &Handle,
                     0x20019ui64,
                     &ObjectAttributes,
                     0i64,
                     0i64,
                     (UINT64)ResultLengthc,
                     (UINT64 *)&Disposition);
        if( ValueKey < 0 )
          goto LABEL_10;
        ZwClose(Handle);
        Handle = 0i64;
      }
      else if( v6 < 0 )
      {
        goto LABEL_10;
      }
      if( !Data )
      {
        ValueKey = ZwQueryValueKey(
                     v16,
                     (PUNICODE_STRING)&CmpCurrentString,
                     KeyValueFullInformation,
                     KeyValueInformation,
                     0x80u,
                     (PULONG)v19);
        if( ValueKey < 0 )
          goto LABEL_10;
        Data = *(int *)((char *)KeyValueInformation + (unsigned int)KeyValueInformation[2]);
      }
      ObjectAttributes.RootDirectory = KeyHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"\"$";
      ObjectAttributes.Attributes = 576;
      LODWORD(ResultLength) = 3;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      ValueKey = ZwCreateKey(
                   &Handle,
                   0x20ui64,
                   &ObjectAttributes,
                   0i64,
                   0i64,
                   (UINT64)ResultLength,
                   (UINT64 *)&Disposition);
      if( ValueKey >= 0 )
      {
        *(_QWORD *)&DestinationString.Length = 0x1000000i64;
        DestinationString.Buffer = (wchar_t *)v21;
        RtlUnicodeStringPrintf(&DestinationString, L"\\Registry\\Machine\\%ws\\ControlSet%03d", LoaderBlock, Data);
        LODWORD(ResultLengtha) = DestinationString.Length;
        ValueKey = ZwSetValueKey(
                     Handle,
                     &CmSymbolicLinkValueName,
                     0i64,
                     6ui64,
                     DestinationString.Buffer,
                     (UINT64)ResultLengtha);
      }
    }
  }
LABEL_10:
  if( Handle )
    ZwClose(Handle);
  if( v16 )
    ZwClose(v16);
  if( KeyHandle )
    ZwClose(KeyHandle);
  return ValueKey;
}

Referenced by: