MigrateOOBELanguageToInstallationLanguage
INT64 __fastcall MigrateOOBELanguageToInstallationLanguage(){
WCHAR v0;
NTSTATUS v1;
WCHAR v2;
unsigned __int16 v3;
__int64 i;
__int16 v5;
unsigned __int16 v6;
WCHAR v7;
PULONG ResultLength;
void *KeyHandle;
ULONG DestinationString;
struct _UNICODE_STRING DestinationString_8;
struct _UNICODE_STRING ValueName_8;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
__int64 v15;
__int16 v16;
char KeyValueInformation[8];
ULONG DataSize;
char Data[516];
*(_QWORD *)&ObjectAttributes.Length = 48i64;
v15 = 0i64;
v16 = 0;
KeyHandle = 0i64;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
DestinationString_8 = 0i64;
memset((INT64)KeyValueInformation, 0i64);
DestinationString = 0;
ValueName_8 = 0i64;
RtlInitUnicodeString(
&DestinationString_8,
L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\NLS\\Language",
v0);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString_8;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v1 = ZwOpenKey(&KeyHandle, 0x2001Fu, &ObjectAttributes);
if( v1 >= 0 )
{
RtlInitUnicodeString(&DestinationString_8, L"InstallLanguage", v2);
v3 = PsInstallUILanguageId;
for( i = 3i64; i >= 0; --i )
{
v5 = 55;
v6 = v3 & 0xF;
if( v6 <= 9u )
v5 = 48;
v3 >>= 4;
*((_WORD *)&v15 + i) = v6 + v5;
}
if( ZwQueryValueKey(
KeyHandle,
&DestinationString_8,
KeyValuePartialInformation,
KeyValueInformation,
0x210u,
&DestinationString) >= 0 )
{
RtlInitUnicodeString(&ValueName_8, L"PreviousInstallLanguage", v7);
LODWORD(ResultLength) = DataSize;
ZwSetValueKey(KeyHandle, &ValueName_8, 0i64, 1ui64, Data, (UINT64)ResultLength);
}
LODWORD(ResultLength) = 10;
v1 = ZwSetValueKey(KeyHandle, &DestinationString_8, 0i64, 1ui64, &v15, (UINT64)ResultLength);
if( v1 >= 0 )
v1 = 0;
}
if( KeyHandle )
ZwClose(KeyHandle);
return(unsigned int)v1;
}Referenced by:
NtFlushInstallUILanguage
NtGetMUIRegistryInfo