HalpWdatExecuteActionBeforeInitialize
NTSTATUS __stdcall HalpWdatExecuteActionBeforeInitialize(
INT64 Action,
UINT64 InputValue,
UINT64 *OutputValue,
WATCHDOG_TIMER_ACTION_TABLE *Wdat,
WATCHDOG_TIMER_RESOURCE_TABLE *Wdrt){
char v6;
NTSTATUS v8;
__int64 i;
NTSTATUS v10;
int v11;
__int16 *v12;
__int64 v13;
NTSTATUS v14;
int v15;
char v17[64];
v6 = Action;
memset((INT64)v17, 0i64);
v8 = 0;
if( Wdat )
{
for( i = 0i64; (unsigned int)i < Wdat->InstructionCount; i = (unsigned int)(i + 1) )
{
if( Wdat->InstructionEntry[i].WatchdogAction == v6 )
{
v10 = WdInstrInitializeInstruction(
v17,
v6,
Wdat->InstructionEntry[i].InstructionFlags,
(__int64)&Wdat->InstructionEntry[i].RegisterRegion,
Wdat->InstructionEntry[i].Value,
Wdat->InstructionEntry[i].Mask,
0);
if( v10 < 0 )
{
v8 = v10;
}
else
{
v11 = WdInstrExecuteInstruction((__int64)v17, 0i64, (unsigned int *)OutputValue);
if( v11 < 0 )
v8 = v11;
WdInstrDestroyInstruction(v17);
}
}
}
}
else if( Wdrt )
{
v12 = &word_140030862;
v13 = 15i64;
do
{
if( *((_BYTE *)v12 - 2) == v6 )
{
v14 = WdInstrInitializeInstruction(
v17,
v6,
*((_BYTE *)v12 - 1),
(__int64)Wdrt + (*(_BYTE *)v12 != 0 ? 48i64 : 36i64),
*(_DWORD *)(v12 + 1),
*(_DWORD *)(v12 + 3),
1);
if( v14 < 0 )
{
v8 = v14;
}
else
{
v15 = WdInstrExecuteInstruction((__int64)v17, 0i64, (unsigned int *)OutputValue);
if( v15 < 0 )
v8 = v15;
WdInstrDestroyInstruction(v17);
}
}
v12 += 6;
--v13;
}
while( v13 );
}
return v8;
}Referenced by:
HalpWdatDiscover