CmpInterlockedFunction

VOID __fastcall CmpInterlockedFunction(VOID *a1){
  NTSTATUS v1; 
  WCHAR v2; 
  PULONG ResultLength; 
  PULONG ResultLengtha; 
  int Data; 
  HANDLE Handle; 
  ULONG v7; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[12]; 
  unsigned __int8 v12; 
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  KeyHandle = 0i64;
  Handle = 0i64;
  v7 = 0;
  ObjectAttributes.RootDirectory = 0i64;
  DestinationString = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &CmRegistryMachineSystemCurrentControlSet;
  ObjectAttributes.Attributes = 576;
  if( ZwOpenKey(&KeyHandle, 0x2001Fu, &ObjectAttributes) >= 0 )
  {
    ObjectAttributes.RootDirectory = KeyHandle;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)L".0";
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v1 = ZwOpenKey(&Handle, 0x2001Fu, &ObjectAttributes);
    ZwClose(KeyHandle);
    if( v1 >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, L"ProcessorControl", v2);
      if( ZwQueryValueKey(Handle, &DestinationString, KeyValuePartialInformation, KeyValueInformation, 0x14u, &v7) < 0
        || (Data = v12, v12 != 2) && v12 != 1 )
      {
        LODWORD(ResultLength) = 4;
        Data = 1;
        ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, (UINT64)ResultLength);
        ZwFlushKey(Handle);
        if( Data != 2 )
        {
          LODWORD(ResultLengtha) = 4;
          Data = 2;
          ZwSetValueKey(Handle, &DestinationString, 0i64, 4ui64, &Data, (UINT64)ResultLengtha);
        }
      }
      ZwClose(Handle);
    }
  }
}

Referenced by: