RtlGetNtProductType
char __fastcall RtlGetNtProductType(_NT_PRODUCT_TYPE *a1){
__int64 v2;
__int64 v3;
INT64 v4;
char v5;
int v6;
__int64 v7;
INT64 *v8;
if( PsIsCurrentThreadInServerSilo() )
{
LOBYTE(v6) = KeIsExecutingInArbitraryThreadContext();
if( v6 || (LODWORD(v7) = PsGetThreadServerSilo((INT64)KeGetCurrentThread()), !v7) )
v8 = &PspHostSiloGlobals;
else
v8 = *(INT64 **)(v7 + 1272);
v5 = 1;
*a1 = *(_NT_PRODUCT_TYPE *)(v8[141] + 16);
}
else
{
v5 = 1;
if( KUSER_SHARED_DATA.ProductTypeIsValid )
{
*a1 = KUSER_SHARED_DATA.NtProductType;
}
else if( KeGetCurrentIrql() > 1u || (int)RtlpGetNtProductTypeFromRegistry(a1, v2, v3, v4) < 0 )
{
*a1 = NtProductWinNt;
return 0;
}
}
return v5;
}Referenced by:
IoFillDumpHeader
IopCreateDefaultDeviceSecurityDescriptor
KeCapturePersistentThreadState
MmWriteTriageInformation
RtlGetVersion
RtlRestoreBootStatusDefaults