ExpWatchProductTypeInitialization
UINT8 __stdcall ExpWatchProductTypeInitialization(){
__int64 v0;
__int64 v1;
WCHAR v2;
PVOID v3;
INT64 v4;
NTSTATUS v5;
NTSTATUS v6;
VOID *v7;
NTSTATUS v8;
NTSTATUS v9;
INT64 v10;
NTSTATUS v11;
VOID *v12;
NTSTATUS v13;
VOID **PoolWithTag;
NTSTATUS v15;
__int64 v16;
NTSTATUS v17;
INT64 v18;
char v20;
__int64 v21;
VOID *v22;
NTSTATUS v23;
unsigned int v24;
VOID **v25;
char v26;
UINT64 v27;
VOID **v28;
unsigned __int64 v29;
UINT64 v30;
unsigned int i;
INT64 v32;
__int64 v33;
__int64 v34;
NTSTATUS v35;
NTSTATUS v36;
VOID **v37;
__int64 v38;
NTSTATUS v39;
NTSTATUS v40;
PVOID *Object;
PVOID *Objecta;
PVOID *Objectb;
PVOID *Objectc;
PVOID *Objectd;
PVOID *Objecte;
PVOID *Objectf;
PVOID *Objectg;
PVOID *Objecth;
PVOID *Objecti;
PVOID *Objectj;
POBJECT_HANDLE_INFORMATION HandleInformation;
POBJECT_HANDLE_INFORMATION HandleInformationa;
POBJECT_HANDLE_INFORMATION HandleInformationb;
POBJECT_HANDLE_INFORMATION HandleInformationc;
INT64 Asynchroneous;
INT64 Asynchroneousa;
INT64 Asynchroneousb;
INT64 Asynchroneousc;
PVOID ChangeBuffer;
PVOID ChangeBuffera;
PVOID ChangeBufferb;
PVOID ChangeBufferc;
UINT64 ResultLength;
_UNICODE_STRING ValueName;
UINT64 v66;
PVOID BugCheckParameter4;
_OBJECT_ATTRIBUTES ObjectAttributes;
_UNICODE_STRING DestinationString;
VOID *KeyHandle;
_UNICODE_STRING v71;
__int128 KeyInformation;
__int128 v73;
__int128 v74;
__int128 v75;
char KeyValueInformation[12];
int v77;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
LODWORD(ResultLength) = 0;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
DestinationString = 0i64;
v3 = 0i64;
KeyHandle = 0i64;
v75 = 0i64;
KUSER_SHARED_DATA.ProductTypeIsValid = 1;
ValueName = 0i64;
ExpSetupModeDetected = 0;
ExpSystemSetupInProgress = 0;
ExpGetNtProductTypeFromLicenseValue(v1, v0, v2);
RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\Setup");
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v5 = NtOpenKey(
(VOID **)&ExpSetupKey,
0x2001Fui64,
&ObjectAttributes,
v4,
(INT64)Object,
(INT64)HandleInformation,
Asynchroneous,
(INT64)ChangeBuffer);
if( v5 < 0 )
KeBugCheckEx(0x9Au, (PVOID)2, (PVOID)(unsigned int)v5, 0i64, 0i64);
BugCheckParameter4 = 0i64;
v6 = ObReferenceObjectByHandle(
*(VOID **)&ExpSetupKey,
0i64,
(_OBJECT_TYPE *)CmKeyObjectType,
0,
&BugCheckParameter4,
0i64);
v7 = BugCheckParameter4;
if( v6 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0xB, (PVOID)(unsigned int)v6, 0i64, 0i64);
RtlInitUnicodeString(&ValueName, L"SetupType");
LODWORD(Objecta) = 72;
v8 = NtQueryValueKey(
*(VOID **)&ExpSetupKey,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
(UINT64)Objecta,
&ResultLength);
if( v8 < 0 )
KeBugCheckEx(0x9Au, (PVOID)3, (PVOID)(unsigned int)v8, 0i64, 0i64);
if( v77 == 1 || v77 == 4 )
{
ExpSetupModeDetected = 1;
KUSER_SHARED_DATA.ProductTypeIsValid = 0;
ObfDereferenceObjectWithTag(v7, 0x746C6644ui64);
v7 = 0i64;
}
RtlInitUnicodeString(&ValueName, L"SystemSetupInProgress");
LODWORD(Objectb) = 72;
v9 = NtQueryValueKey(
*(VOID **)&ExpSetupKey,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
(UINT64)Objectb,
&ResultLength);
if( v9 < 0 )
KeBugCheckEx(0x9Au, (PVOID)3, (PVOID)(unsigned int)v9, 0i64, 0i64);
if( v77 == 1 )
ExpSystemSetupInProgress = 1;
ExpLicenseWatchInitWorker();
if( InitIsWinPEMode )
{
*(&ExBootDevicesRemovedEvent + 42) = v7;
return 1;
}
*(&ExBootDevicesRemovedEvent + 34) = ExpWatchProductTypeWork;
*(&ExBootDevicesRemovedEvent + 35) = 0i64;
*(&ExBootDevicesRemovedEvent + 32) = 0i64;
RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions");
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v11 = NtOpenKey(
(VOID **)&ExBootDevicesRemovedEvent + 38,
0x2001Fui64,
&ObjectAttributes,
v10,
(INT64)Objectc,
(INT64)HandleInformationa,
Asynchroneousa,
(INT64)ChangeBuffera);
if( v11 < 0 )
{
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, (PVOID)6, (PVOID)(unsigned int)v11, 0i64, 0i64);
}
else
{
if( !ExpSetupModeDetected )
{
BugCheckParameter4 = 0i64;
v13 = ObReferenceObjectByHandle(
*(&ExBootDevicesRemovedEvent + 38),
0i64,
(_OBJECT_TYPE *)CmKeyObjectType,
0,
&BugCheckParameter4,
0i64);
v3 = BugCheckParameter4;
if( v13 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0xC, (PVOID)(unsigned int)v13, 0i64, 0i64);
}
*(&ExBootDevicesRemovedEvent + 42) = v7;
*(&ExBootDevicesRemovedEvent + 43) = v3;
ExpUpdateProductSuiteTypeInRegistry(v12);
RtlInitUnicodeString(&ValueName, L"ProductType");
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x22ui64, 544826699i64);
*(&ExBootDevicesRemovedEvent + 25) = PoolWithTag;
if( PoolWithTag )
{
LODWORD(Objectd) = 34;
v15 = NtQueryValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
KeyValuePartialInformation,
PoolWithTag,
(UINT64)Objectd,
&ResultLength);
if( v15 < 0 )
{
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, (PVOID)7, (PVOID)(unsigned int)v15, 0i64, 0i64);
}
else
{
RtlInitUnicodeString(&ValueName, L"ProductSuite");
LODWORD(Objecte) = 16;
if( NtQueryValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
KeyValuePartialInformation,
&v75,
(UINT64)Objecte,
&ResultLength) != -2147483643 )
goto LABEL_18;
LODWORD(ResultLength) = ResultLength + 16;
qword_140C53FE0 = ExAllocatePoolWithTag(1ui64, (unsigned int)ResultLength, 544826699i64);
if( !qword_140C53FE0 )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)(unsigned int)ResultLength, (PVOID)2, 0i64);
LODWORD(Objectf) = ResultLength;
if( NtQueryValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
KeyValuePartialInformation,
qword_140C53FE0,
(UINT64)Objectf,
&ResultLength) >= 0
|| (ExFreePoolWithTag(qword_140C53FE0, 0), qword_140C53FE0 = 0i64, !ExpSetupModeDetected) )
{
LABEL_18:
v16 = -1i64;
do
++v16;
while( aLanmannt[v16] );
if( !wcsncmp(L"LanmanNT", (const WCHAR *)(*(&ExBootDevicesRemovedEvent + 25) + 12i64), v16)
&& InitSafeBootMode == 3
&& !ExpSetupModeDetected )
{
KUSER_SHARED_DATA.ProductTypeIsValid = 1;
KUSER_SHARED_DATA.NtProductType = NtProductServer;
}
v17 = NtNotifyChangeKey(
*(&ExBootDevicesRemovedEvent + 76),
0,
(PIO_APC_ROUTINE)((char *)&ExBootDevicesRemovedEvent + 256),
(PVOID)1,
(PIO_STATUS_BLOCK)&ExBootDevicesRemovedEvent + 18,
0x10000005u,
0,
(char *)&ExBootDevicesRemovedEvent + 208,
4u,
1u);
if( v17 >= 0 )
{
RtlInitUnicodeString(
&DestinationString,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LicenseInfoSuites");
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( NtOpenKey(
&KeyHandle,
0x20019ui64,
&ObjectAttributes,
v18,
(INT64)Objectg,
(INT64)HandleInformationb,
Asynchroneousb,
(INT64)ChangeBufferb) >= 0 )
{
LODWORD(v66) = 0;
KeyInformation = 0i64;
v20 = 0;
v21 = -1i64;
v73 = 0i64;
v74 = 0i64;
ValueName = 0i64;
v71 = 0i64;
do
++v21;
while( aRegistryMachin_157[v21] );
ValueName.Length = 2 * (v21 + 64);
ValueName.MaximumLength = ValueName.Length;
ValueName.Buffer = (wchar_t *)ExAllocatePoolWithTag(0x200ui64, ValueName.Length, 544826699i64);
if( !ValueName.Buffer )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)ValueName.Length, (PVOID)3, 0i64);
v22 = KeyHandle;
v23 = NtQueryKey(KeyHandle, KeyFullInformation, &KeyInformation, 0x30ui64, &v66);
if( v23 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x13, (PVOID)v23, (PVOID)1, 0i64);
v24 = 2 * DWORD2(v73) + 56;
if( v24 < DWORD2(v73) || v24 < 2 * (unsigned __int64)(unsigned int)(DWORD2(v73) + 16) )
v20 = 1;
v25 = ExAllocatePoolWithTag(0x200ui64, v24, 544826699i64);
if( !v25 || v20 )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)v24, (PVOID)4, 0i64);
v26 = 0;
LODWORD(BugCheckParameter4) = DWORD2(v74) + 32;
if( (unsigned int)(DWORD2(v74) + 32) < DWORD2(v74) )
v26 = 1;
v27 = (unsigned int)(DWORD2(v74) + 32);
v28 = ExAllocatePoolWithTag(0x200ui64, v27, 544826699i64);
if( !v28 || v26 )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)v27, (PVOID)5, 0i64);
*(&ExBootDevicesRemovedEvent + 56) = DWORD1(v73);
v29 = 80i64 * DWORD1(v73);
if( v29 > 0xFFFFFFFF )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)v29, (PVOID)6, 0i64);
*(&ExBootDevicesRemovedEvent + 27) = ExAllocatePoolWithTag(0x200ui64, (unsigned int)v29, 544826699i64);
if( !*(&ExBootDevicesRemovedEvent + 27) )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)(80i64 * *(&ExBootDevicesRemovedEvent + 56)), (PVOID)6, 0i64);
RtlInitUnicodeString(&v71, L"ConcurrentLimit");
v30 = 0i64;
for( i = 0; ; v30 = i )
{
LODWORD(Objecth) = v24;
v40 = NtEnumerateKey(v22, v30, KeyBasicInformation, v25, (UINT64)Objecth, &v66);
if( v40 == -2147483622 )
break;
if( v40 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x1A, (PVOID)v40, 0i64, 0i64);
*((_WORD *)v25 + ((unsigned __int64)*((unsigned int *)v25 + 3) >> 1) + 8) = 0;
wcscpy_s(
ValueName.Buffer,
(unsigned __int64)ValueName.MaximumLength >> 1,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LicenseInfoSuites");
wcscat_s(ValueName.Buffer, (unsigned __int64)ValueName.MaximumLength >> 1, (WCHAR *)L"\\");
wcscat_s(ValueName.Buffer, (unsigned __int64)ValueName.MaximumLength >> 1, (WCHAR *)v25 + 8);
v33 = -1i64;
do
++v33;
while( ValueName.Buffer[v33] );
ObjectAttributes.RootDirectory = 0i64;
ValueName.Length = 2 * v33;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &ValueName;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v34 = 80i64 * i;
v35 = NtOpenKey(
(VOID **)(v34 + *(&ExBootDevicesRemovedEvent + 27)),
0x2001Fui64,
&ObjectAttributes,
v32,
(INT64)Objectj,
(INT64)HandleInformationc,
Asynchroneousc,
(INT64)ChangeBufferc);
if( v35 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x16, (PVOID)v35, (PVOID)1, 0i64);
LODWORD(Objecti) = (_DWORD)BugCheckParameter4;
v36 = NtQueryValueKey(
*(VOID **)(v34 + *(&ExBootDevicesRemovedEvent + 27)),
&v71,
KeyValuePartialInformation,
v28,
(UINT64)Objecti,
&v66);
if( v36 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x13, (PVOID)v36, (PVOID)2, 0i64);
v37 = ExAllocatePoolWithTag(0x200ui64, ValueName.Length, 544826699i64);
*(_QWORD *)(v34 + *(&ExBootDevicesRemovedEvent + 27) + 16) = v37;
if( !v37 )
KeBugCheckEx(0x9Au, (PVOID)0x14, (PVOID)ValueName.Length, (PVOID)7, 0i64);
wcscpy_s((PWCHAR)v37, (unsigned __int64)ValueName.Length >> 1, ValueName.Buffer);
v38 = v34 + *(&ExBootDevicesRemovedEvent + 27);
*(_DWORD *)(v38 + 8) = *((_DWORD *)v28 + 3);
*(_QWORD *)(v38 + 48) = v38;
*(_QWORD *)(v38 + 24) = 0i64;
*(_QWORD *)(v38 + 40) = ExpWatchLicenseInfoWork;
v39 = NtNotifyChangeKey(
*(_QWORD *)v38,
0,
(PIO_APC_ROUTINE)(v38 + 24),
(PVOID)1,
(PIO_STATUS_BLOCK)(v38 + 56),
0x10000005u,
1u,
(PVOID)(v38 + 72),
4u,
1u);
if( v39 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x18, (PVOID)v39, (PVOID)1, 0i64);
++i;
}
ExFreePoolWithTag(v25, 0);
ExFreePoolWithTag(v28, 0);
ExFreePoolWithTag(ValueName.Buffer, 0);
NtClose((UINT64)v22);
}
return 1;
}
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, (PVOID)8, (PVOID)(unsigned int)v17, 0i64, 0i64);
}
}
}
}
return 0;
}Referenced by:
ExInitSystemPhase2