ExpWatchProductTypeInitialization
INT64 __fastcall ExpWatchProductTypeInitialization(){
INT64 v0;
INT64 v1;
WCHAR v2;
struct _DMA_ADAPTER *v3;
WCHAR v4;
NTSTATUS v5;
NTSTATUS v6;
WCHAR v7;
struct _DMA_ADAPTER *v8;
int v9;
WCHAR v10;
int v11;
INT64 result;
WCHAR v13;
void *v14;
NTSTATUS v15;
WCHAR v16;
WCHAR v17;
size_t v18;
WCHAR v19;
char v20;
__int64 v21;
void *v22;
NTSTATUS v23;
unsigned int v24;
WCHAR *PoolWithTag;
char v26;
UINT64 v27;
_DWORD *v28;
ULONG_PTR v29;
WCHAR v30;
UINT64 v31;
unsigned int i;
__int64 v33;
__int64 v34;
NTSTATUS v35;
int v36;
WCHAR *v37;
__int64 v38;
NTSTATUS v39;
NTSTATUS v40;
PVOID *Object;
PVOID *Objecta;
PVOID *Objectb;
PVOID *Objectc;
PVOID *Objectd;
PVOID *Objecte;
PVOID *Objectf;
BOOL Asynchroneous;
BOOL Asynchroneousa;
BOOL WatchSubtree;
BOOL WatchSubtreea;
UINT64 ResultLength;
struct _UNICODE_STRING ValueName;
UINT64 v54;
PVOID v55;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
struct _UNICODE_STRING DestinationString;
void *KeyHandle;
struct _UNICODE_STRING v59;
__int128 KeyInformation;
__int128 v61;
__int128 v62;
__int128 v63;
char KeyValueInformation[12];
int v65;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
LODWORD(ResultLength) = 0;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
DestinationString = 0i64;
v3 = 0i64;
KeyHandle = 0i64;
v63 = 0i64;
KUSER_SHARED_DATA.ProductTypeIsValid = 1;
ValueName = 0i64;
ExpSetupModeDetected = 0;
ExpSystemSetupInProgress = 0;
ExpGetNtProductTypeFromLicenseValue(v1, v0, v2);
RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\Setup", v4);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v5 = NtOpenKey(&ExpSetupKey, 0x2001Fui64, &ObjectAttributes);
if( v5 < 0 )
KeBugCheckEx(0x9Au, 2ui64, (unsigned int)v5, 0i64, 0i64);
v55 = 0i64;
v6 = ObReferenceObjectByHandle(ExpSetupKey, 0, (POBJECT_TYPE)CmKeyObjectType, 0, &v55, 0i64);
v8 = (struct _DMA_ADAPTER *)v55;
if( v6 < 0 )
KeBugCheckEx(0x9Au, 0xBui64, (unsigned int)v6, 0i64, 0i64);
RtlInitUnicodeString(&ValueName, L"SetupType", v7);
LODWORD(Object) = 72;
v9 = NtQueryValueKey(
ExpSetupKey,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
(UINT64)Object,
&ResultLength);
if( v9 < 0 )
KeBugCheckEx(0x9Au, 3ui64, (unsigned int)v9, 0i64, 0i64);
if( v65 == 1 || v65 == 4 )
{
ExpSetupModeDetected = 1;
KUSER_SHARED_DATA.ProductTypeIsValid = 0;
ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
v8 = 0i64;
}
RtlInitUnicodeString(&ValueName, L"SystemSetupInProgress", v10);
LODWORD(Objecta) = 72;
v11 = NtQueryValueKey(
ExpSetupKey,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
(UINT64)Objecta,
&ResultLength);
if( v11 < 0 )
KeBugCheckEx(0x9Au, 3ui64, (unsigned int)v11, 0i64, 0i64);
if( v65 == 1 )
ExpSystemSetupInProgress = 1;
result = ExpLicenseWatchInitWorker();
if( InitIsWinPEMode )
{
ExpControlKey = v8;
LABEL_23:
LOBYTE(result) = 1;
return result;
}
qword_140C19310 = (__int64)ExpWatchProductTypeWork;
qword_140C19318 = 0i64;
*(_QWORD *)ExpWatchProductTypeWorkItem = 0i64;
RtlInitUnicodeString(
&DestinationString,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions",
v13);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
LODWORD(result) = NtOpenKey(&ExpProductTypeKey, 0x2001Fui64, &ObjectAttributes);
if( (int)result < 0 )
{
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, 6ui64, (unsigned int)result, 0i64, 0i64);
}
else
{
if( !ExpSetupModeDetected )
{
v55 = 0i64;
v15 = ObReferenceObjectByHandle(ExpProductTypeKey, 0, (POBJECT_TYPE)CmKeyObjectType, 0, &v55, 0i64);
v3 = (struct _DMA_ADAPTER *)v55;
if( v15 < 0 )
KeBugCheckEx(0x9Au, 0xCui64, (unsigned int)v15, 0i64, 0i64);
}
ExpControlKey = v8;
DmaAdapter = v3;
ExpUpdateProductSuiteTypeInRegistry(v14);
RtlInitUnicodeString(&ValueName, L"ProductType", v16);
result = (INT64)ExAllocatePoolWithTag(PagedPool, 0x22ui64, 0x2079654Bui64);
*(_QWORD *)ExpProductTypeValueInfo = result;
if( result )
{
LODWORD(Objectb) = 34;
result = NtQueryValueKey(
ExpProductTypeKey,
&ValueName,
KeyValuePartialInformation,
(VOID *)result,
(UINT64)Objectb,
&ResultLength);
if( (int)result < 0 )
{
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, 7ui64, (unsigned int)result, 0i64, 0i64);
}
else
{
RtlInitUnicodeString(&ValueName, L"ProductSuite", v17);
LODWORD(Objectc) = 16;
if( (unsigned int)NtQueryValueKey(
ExpProductTypeKey,
&ValueName,
KeyValuePartialInformation,
&v63,
(UINT64)Objectc,
&ResultLength) != -2147483643 )
goto LABEL_18;
LODWORD(ResultLength) = ResultLength + 16;
qword_140C53FE0 = ExAllocatePoolWithTag(PagedPool, (unsigned int)ResultLength, 0x2079654Bui64);
if( !qword_140C53FE0 )
KeBugCheckEx(0x9Au, 0x14ui64, (unsigned int)ResultLength, 2ui64, 0i64);
LODWORD(Objectd) = ResultLength;
if( (int)NtQueryValueKey(
ExpProductTypeKey,
&ValueName,
KeyValuePartialInformation,
qword_140C53FE0,
(UINT64)Objectd,
&ResultLength) >= 0
|| (ExFreePoolWithTag(qword_140C53FE0, 0), qword_140C53FE0 = 0i64, !ExpSetupModeDetected) )
{
LABEL_18:
v18 = -1i64;
do
++v18;
while( aLanmannt[v18] );
if( !(unsigned int)wcsncmp(L"LanmanNT", (const WCHAR *)(*(_QWORD *)ExpProductTypeValueInfo + 12i64), v18)
&& InitSafeBootMode == 3
&& !ExpSetupModeDetected )
{
KUSER_SHARED_DATA.ProductTypeIsValid = 1;
KUSER_SHARED_DATA.NtProductType = NtProductServer;
}
LOBYTE(WatchSubtree) = 1;
LOBYTE(Asynchroneous) = 0;
LODWORD(result) = NtNotifyChangeKey(
ExpProductTypeKey,
0i64,
ExpWatchProductTypeWorkItem,
(PVOID)1,
&ExpProductTypeIoSb,
0x10000005u,
Asynchroneous,
ExpProductTypeChangeBuffer,
4u,
WatchSubtree);
if( (int)result >= 0 )
{
RtlInitUnicodeString(
&DestinationString,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LicenseInfoSuites",
v19);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
LODWORD(result) = NtOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes);
if( (int)result >= 0 )
{
LODWORD(v54) = 0;
KeyInformation = 0i64;
v20 = 0;
v21 = -1i64;
v61 = 0i64;
v62 = 0i64;
ValueName = 0i64;
v59 = 0i64;
do
++v21;
while( aRegistryMachin_157[v21] );
ValueName.Length = 2 * (v21 + 64);
ValueName.MaximumLength = ValueName.Length;
ValueName.Buffer = (wchar_t *)ExAllocatePoolWithTag(NonPagedPoolNx, ValueName.Length, 0x2079654Bui64);
if( !ValueName.Buffer )
KeBugCheckEx(0x9Au, 0x14ui64, ValueName.Length, 3ui64, 0i64);
v22 = KeyHandle;
v23 = NtQueryKey(KeyHandle, KeyFullInformation, &KeyInformation, 0x30ui64, &v54);
if( v23 < 0 )
KeBugCheckEx(0x9Au, 0x13ui64, v23, 1ui64, 0i64);
v24 = 2 * DWORD2(v61) + 56;
if( v24 < DWORD2(v61) || v24 < 2 * (unsigned __int64)(unsigned int)(DWORD2(v61) + 16) )
v20 = 1;
PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, v24, 0x2079654Bui64);
if( !PoolWithTag || v20 )
KeBugCheckEx(0x9Au, 0x14ui64, v24, 4ui64, 0i64);
v26 = 0;
LODWORD(v55) = DWORD2(v62) + 32;
if( (unsigned int)(DWORD2(v62) + 32) < DWORD2(v62) )
v26 = 1;
v27 = (unsigned int)(DWORD2(v62) + 32);
v28 = ExAllocatePoolWithTag(NonPagedPoolNx, v27, 0x2079654Bui64);
if( !v28 || v26 )
KeBugCheckEx(0x9Au, 0x14ui64, v27, 5ui64, 0i64);
ExpLicenseInfoCount = DWORD1(v61);
v29 = 80i64 * DWORD1(v61);
if( v29 > 0xFFFFFFFF )
KeBugCheckEx(0x9Au, 0x14ui64, v29, 6ui64, 0i64);
ExpLicenseInfo = (__int64)ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)v29, 0x2079654Bui64);
if( !ExpLicenseInfo )
KeBugCheckEx(0x9Au, 0x14ui64, 80i64 * (unsigned int)ExpLicenseInfoCount, 6ui64, 0i64);
RtlInitUnicodeString(&v59, L"ConcurrentLimit", v30);
v31 = 0i64;
for( i = 0; ; v31 = i )
{
LODWORD(Objecte) = v24;
v40 = NtEnumerateKey(v22, v31, KeyBasicInformation, PoolWithTag, (UINT64)Objecte, &v54);
if( v40 == -2147483622 )
break;
if( v40 < 0 )
KeBugCheckEx(0x9Au, 0x1Aui64, v40, 0i64, 0i64);
PoolWithTag[((unsigned __int64)*((unsigned int *)PoolWithTag + 3) >> 1) + 8] = 0;
wcscpy_s(
ValueName.Buffer,
(unsigned __int64)ValueName.MaximumLength >> 1,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LicenseInfoSuites");
wcscat_s(ValueName.Buffer, (unsigned __int64)ValueName.MaximumLength >> 1, L"\\");
wcscat_s(ValueName.Buffer, (unsigned __int64)ValueName.MaximumLength >> 1, PoolWithTag + 8);
v33 = -1i64;
do
++v33;
while( ValueName.Buffer[v33] );
ObjectAttributes.RootDirectory = 0i64;
ValueName.Length = 2 * v33;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &ValueName;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v34 = 80i64 * i;
v35 = NtOpenKey((PVOID *)(v34 + ExpLicenseInfo), 0x2001Fui64, &ObjectAttributes);
if( v35 < 0 )
KeBugCheckEx(0x9Au, 0x16ui64, v35, 1ui64, 0i64);
LODWORD(Objectf) = (_DWORD)v55;
v36 = NtQueryValueKey(
*(VOID **)(v34 + ExpLicenseInfo),
&v59,
KeyValuePartialInformation,
v28,
(UINT64)Objectf,
&v54);
if( v36 < 0 )
KeBugCheckEx(0x9Au, 0x13ui64, v36, 2ui64, 0i64);
v37 = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, ValueName.Length, 0x2079654Bui64);
*(_QWORD *)(v34 + ExpLicenseInfo + 16) = v37;
if( !v37 )
KeBugCheckEx(0x9Au, 0x14ui64, ValueName.Length, 7ui64, 0i64);
wcscpy_s(v37, (unsigned __int64)ValueName.Length >> 1, ValueName.Buffer);
v38 = v34 + ExpLicenseInfo;
*(_DWORD *)(v38 + 8) = v28[3];
*(_QWORD *)(v38 + 48) = v38;
*(_QWORD *)(v38 + 24) = 0i64;
LOBYTE(WatchSubtreea) = 1;
*(_QWORD *)(v38 + 40) = ExpWatchLicenseInfoWork;
LOBYTE(Asynchroneousa) = 1;
v39 = NtNotifyChangeKey(
*(HANDLE *)v38,
0i64,
(PIO_APC_ROUTINE)(v38 + 24),
(PVOID)1,
(PIO_STATUS_BLOCK)(v38 + 56),
0x10000005u,
Asynchroneousa,
(PVOID)(v38 + 72),
4u,
WatchSubtreea);
if( v39 < 0 )
KeBugCheckEx(0x9Au, 0x18ui64, v39, 1ui64, 0i64);
++i;
}
ExFreePoolWithTag(PoolWithTag, 0);
ExFreePoolWithTag(v28, 0);
ExFreePoolWithTag(ValueName.Buffer, 0);
LODWORD(result) = NtClose(v22);
}
goto LABEL_23;
}
if( !ExpSetupModeDetected )
KeBugCheckEx(0x9Au, 8ui64, (unsigned int)result, 0i64, 0i64);
}
}
}
}
LOBYTE(result) = 0;
return result;
}Referenced by:
ExInitSystemPhase2