RtlpGetNtProductTypeFromRegistry
INT64 __stdcall RtlpGetNtProductTypeFromRegistry(PNT_PRODUCT_TYPE NtProductType){
NTSTATUS v2;
ULONG ResultLength;
void *KeyHandle;
UNICODE_STRING String1;
__int64 v7[2];
struct _UNICODE_STRING ValueName;
UNICODE_STRING String2;
UNICODE_STRING v10;
UNICODE_STRING v11;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
char KeyValueInformation[4];
int v14;
unsigned int v15;
int v16;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ResultLength = 0;
*(_DWORD *)(&String1.MaximumLength + 1) = 0;
KeyHandle = 0i64;
ObjectAttributes.RootDirectory = 0i64;
v7[1] = (__int64)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
ValueName.Buffer = L"ProductType";
v10.Buffer = L"LanmanNt";
v11.Buffer = L"ServerNt";
String2.Buffer = L"WinNt";
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v7;
v7[0] = 8650882i64;
*(_QWORD *)&ValueName.Length = 1572886i64;
*(_QWORD *)&v10.Length = 1179664i64;
*(_QWORD *)&v11.Length = 1179664i64;
*(_QWORD *)&String2.Length = 786442i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
v2 = ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes);
if( v2 >= 0 )
{
v2 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, 0x24u, &ResultLength);
if( v2 >= 0 )
{
if( v14 == 1 && v15 >= 2 )
{
String1.MaximumLength = v15;
String1.Buffer = (wchar_t *)&v16;
String1.Length = v15 - 2;
if( RtlEqualUnicodeString(&String1, &String2, 1u) )
{
*NtProductType = NtProductWinNt;
goto LABEL_9;
}
if( RtlEqualUnicodeString(&String1, &v10, 1u) )
{
*NtProductType = NtProductLanManNt;
goto LABEL_9;
}
if( RtlEqualUnicodeString(&String1, &v11, 1u) )
{
*NtProductType = NtProductServer;
goto LABEL_9;
}
}
v2 = -1073739509;
}
}
LABEL_9:
if( KeyHandle )
ZwClose(KeyHandle);
return(unsigned int)v2;
}Referenced by:
PspSiloInitializeUserSharedData
RtlGetNtProductType