BapdpProcessVsmKeyBlobs

VOID __fastcall BapdpProcessVsmKeyBlobs(INT64 a1){
  int v1; 
  ULONG *PoolWithTag; 
  WCHAR *v3; 
  unsigned int v4; 
  GUID *v5; 
  WCHAR v6; 
  unsigned int v7; 
  __int64 *v8; 
  NTSTATUS ValueKey; 
  NTSTATUS Data; 
  WCHAR *v11; 
  __int64 v12; 
  bool IsStateSeparationEnabled; 
  __int64 v14; 
  WCHAR *v15; 
  WCHAR v16; 
  WCHAR v17; 
  WCHAR *v18; 
  PULONG ResultLength; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  ULONG DataSize[2]; 
  HANDLE KeyHandle; 
  PVOID DestinationString[3]; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v29[4]; 
  __int64 v30[2]; 
  int v31; 
  int v32; 
  int v33; 
  int v34; 
  const wchar_t *v35; 
  const wchar_t *v36; 
  int v37; 
  int v38; 
  int v39; 
  int v40; 
  const wchar_t *v41; 
  const wchar_t *v42; 
  v29[0] = -937207777;
  DataSize[0] = 0;
  KeyHandle = 0i64;
  memset(DestinationString, 0, sizeof(DestinationString));
  v30[0] = (__int64)L"VsmIdkBlob";
  v1 = a1;
  v29[1] = 1254716583;
  v30[1] = (__int64)L"system32\\config\\VSMIDK";
  v29[2] = -1274918465;
  v35 = L"VsmHbkBlob";
  PoolWithTag = 0i64;
  v29[3] = 1271024649;
  v36 = L"system32\\config\\VSMHBK";
  v3 = 0i64;
  v31 = 1759588193;
  v41 = L"VsmLKeyBlob";
  v4 = 0;
  v32 = 1265287039;
  v42 = L"system32\\config\\VSMLKEY";
  IoStatusBlock = 0i64;
  v33 = 1264598702;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v34 = 1186665675;
  v37 = 646995484;
  v38 = 1215474106;
  v39 = -1787939400;
  v40 = -970048220;
  if( BapdGetISRegistryKey(&KeyHandle) < 0 )
    goto LABEL_13;
  v7 = 0;
  v8 = v30;
  while( 1 )
  {
    if( PoolWithTag )
    {
      ExFreePoolWithTag(PoolWithTag, 0);
      PoolWithTag = 0i64;
    }
    DataSize[0] = 0;
    if( !v1 )
    {
      Data = BapdpQueryData(v5, (UINT64)&v29[8 * v7], 0i64, 0i64);
      if( Data != -1073741789 )
        goto LABEL_17;
      PoolWithTag = (ULONG *)ExAllocatePoolWithTag(NonPagedPoolNx, DataSize[0], 0x64506142ui64);
      if( PoolWithTag )
      {
        Data = 0;
LABEL_17:
        if( Data >= 0 && BapdpQueryData(v5, (UINT64)&v29[8 * v7], 0i64, (UINT64 *)PoolWithTag) >= 0 )
        {
          RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], (PCWSTR)*v8, v6);
          LODWORD(ResultLength) = DataSize[0];
          ZwSetValueKey(
            KeyHandle,
            (UNICODE_STRING *)&DestinationString[1],
            0i64,
            3ui64,
            PoolWithTag,
            (UINT64)ResultLength);
        }
        goto LABEL_8;
      }
      goto LABEL_8;
    }
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], (PCWSTR)*v8, v6);
    ValueKey = ZwQueryValueKey(
                 KeyHandle,
                 (PUNICODE_STRING)&DestinationString[1],
                 KeyValuePartialInformation,
                 0i64,
                 0,
                 DataSize);
    if( ValueKey != -1073741789 )
      goto LABEL_7;
    PoolWithTag = (ULONG *)ExAllocatePoolWithTag(NonPagedPoolNx, DataSize[0], 0x64506142ui64);
    if( PoolWithTag )
      break;
LABEL_8:
    ++v7;
    v8 += 4;
    if( v7 >= 3 )
      goto LABEL_9;
  }
  ValueKey = 0;
LABEL_7:
  if( ValueKey < 0
    || ZwQueryValueKey(
         KeyHandle,
         (PUNICODE_STRING)&DestinationString[1],
         KeyValuePartialInformation,
         PoolWithTag,
         DataSize[0],
         DataSize) < 0 )
  {
    goto LABEL_8;
  }
  ZwDeleteValueKey(KeyHandle, (UNICODE_STRING *)&DestinationString[1]);
  if( v3 )
  {
    v3[v4] = 0;
LABEL_42:
    if( RtlStringCchCatW(v3, 0x104ui64, (PWCHAR)v8[1]) >= 0 )
    {
      RtlInitUnicodeStringEx((UNICODE_STRING *)&DestinationString[1], v3);
      LODWORD(EaLength) = 0;
      LODWORD(CreateOptions) = 96;
      LODWORD(CreateDisposition) = 0;
      LODWORD(ShareAccess) = 0;
      LODWORD(ResultLength) = 128;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      if( ZwCreateFile(
             DestinationString,
             0x40100000ui64,
             &ObjectAttributes,
             &IoStatusBlock,
             0i64,
             (UINT64)ResultLength,
             ShareAccess,
             CreateDisposition,
             CreateOptions,
             0i64,
             EaLength) >= 0 )
      {
        ZwWriteFile(DestinationString[0], 0i64, 0i64, 0i64, &IoStatusBlock, PoolWithTag + 3, PoolWithTag[2], 0i64, 0i64);
        ZwClose(DestinationString[0]);
        DestinationString[0] = 0i64;
      }
    }
    goto LABEL_8;
  }
  v11 = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x208ui64, 0x656E6F4Eui64);
  v3 = v11;
  if( v11 )
  {
    v12 = -(__int64)v11;
    IsStateSeparationEnabled = RtlIsStateSeparationEnabled();
    v14 = 260i64;
    v15 = v3;
    if( IsStateSeparationEnabled )
    {
      do
      {
        if( v14 == -2147483386 )
          break;
        v16 = *(WCHAR *)((char *)v15 + (_QWORD)L"\\OSDataRoot\\Windows\\" + v12);
        if( !v16 )
          break;
        *v15++ = v16;
        --v14;
      }
      while( v14 );
      v4 = 20;
    }
    else
    {
      do
      {
        if( v14 == -2147483386 )
          break;
        v17 = *(WCHAR *)((char *)v15 + (_QWORD)L"\\SystemRoot\\" + v12);
        if( !v17 )
          break;
        *v15++ = v17;
        --v14;
      }
      while( v14 );
      v4 = 12;
    }
    v18 = v15 - 1;
    if( v14 )
      v18 = v15;
    *v18 = 0;
    if( v14 )
      goto LABEL_42;
  }
LABEL_9:
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
LABEL_13:
  if( KeyHandle )
    ZwClose(KeyHandle);
}

Referenced by: