CmpMountPreloadedHives
VOID __stdcall CmpMountPreloadedHives(){
int v0;
wchar_t *v1;
__int64 v2;
int v3;
int v4;
__int64 v5;
WCHAR *v6;
int SystemPartition;
int v8;
unsigned int v9;
unsigned int v10;
unsigned int i;
ULONG v12;
EVENT_DESCRIPTOR *v13;
int v14;
PKRESOURCEMANAGER *v15;
ULONG_PTR BugCheckParameter4;
UINT64 BugCheckParameter4a;
_UNICODE_STRING Destination_8;
WCHAR Source[2];
INT64 a4;
INT64 v21;
unsigned int v22;
int v23;
char Response[12];
__int64 a3;
__int64 v26;
__int64 v27;
UINT64 Parameters;
wchar_t *PoolWithTag;
INT64 result[54];
_KAPC_STATE ApcState;
v0 = 0;
Parameters = 0i64;
memset(Response, 0, sizeof(Response));
v23 = 0;
Destination_8 = 0i64;
memset((INT64)result, 0i64);
v21 = 0i64;
v26 = 0i64;
v27 = 0i64;
a4 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
a3 = 0i64;
*(_DWORD *)Source = 0;
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, 0x1000ui64, 0x62534D43ui64);
v1 = PoolWithTag;
if( !PoolWithTag )
KeBugCheckEx(0x74u, 2ui64, 1ui64, 0i64, 0xFFFFFFFFC000009Aui64);
v2 = CmpPreloadedHivesList;
if( (__int64 *)CmpPreloadedHivesList != &CmpPreloadedHivesList )
{
while( 1 )
{
v3 = *(_DWORD *)(v2 - 1456) & 0x1000000;
if( (*(_DWORD *)(v2 - 1456) & 1) != 0 )
goto LABEL_45;
*(_QWORD *)&Destination_8.Length = 0x10000000i64;
Destination_8.Buffer = v1;
if( !CmpQueryHiveRedirectionFileList((_UNICODE_STRING *)(v2 + 232), &Destination_8) || Destination_8.Length == 2 )
break;
LABEL_17:
ExFreePoolWithTag(*(PVOID *)(v2 + 208), 0);
*(_OWORD *)(v2 + 200) = 0i64;
LODWORD(BugCheckParameter4) = 7;
*(_WORD *)(v2 + 202) = 0;
*(_QWORD *)(v2 + 208) = 0i64;
SystemPartition = CmpOpenHiveFile(
&Destination_8,
0i64,
&a3,
&a4,
BugCheckParameter4,
0i64,
(INT64)&Response[4],
0i64,
0i64);
if( SystemPartition < 0 )
{
v0 = 16;
LABEL_52:
*(_QWORD *)(v2 - 1560) = result;
result[0] = v2 - 1616;
LODWORD(BugCheckParameter4) = v0;
SetFailureLocation(*(_QWORD *)(v2 - 1560), 0i64, 21i64, (unsigned int)SystemPartition, BugCheckParameter4);
BYTE6(NlsMbCodePageTag) = 1;
Parameters = (UINT64)&Destination_8;
LODWORD(BugCheckParameter4a) = 1;
ExRaiseHardError(3221226008i64, 1ui64, 1ui64, &Parameters, BugCheckParameter4a, (UINT64 *)Response);
KeBugCheckEx(0x74u, 2ui64, 1ui64, v2 - 1616, SystemPartition);
}
v8 = 2;
if( (_DWORD)a4 == 2 )
v8 = 18;
LODWORD(BugCheckParameter4) = v8;
SystemPartition = CmpOpenHiveFile(&Destination_8, 4ui64, &v26, &v21, BugCheckParameter4, 0i64, 0i64, 0i64, 0i64);
if( SystemPartition < 0 )
{
v0 = 32;
goto LABEL_52;
}
LODWORD(BugCheckParameter4) = v8;
SystemPartition = CmpOpenHiveFile(
&Destination_8,
5ui64,
&v27,
(INT64 *)((char *)&v21 + 4),
BugCheckParameter4,
0i64,
0i64,
0i64,
0i64);
if( SystemPartition < 0 )
{
v0 = 48;
goto LABEL_52;
}
v9 = *(_DWORD *)&Response[4];
*(_QWORD *)(v2 - 80) = a3;
*(_QWORD *)(v2 - 48) = v26;
*(_QWORD *)(v2 - 40) = v27;
*(_DWORD *)(v2 - 1456) &= ~2u;
v10 = *(_DWORD *)(v2 - 1344) + 4096;
*(_DWORD *)(v2 - 1432) = *(_DWORD *)&Response[8];
v22 = v10;
if( *(_DWORD *)(v2 - 1480) != v9 )
{
for( i = 0; i < *(_DWORD *)(v2 - 1528); i += v9 )
{
if( !RtlAreBitsClear((RTL_BITMAP *)(v2 - 1528), i, v9) )
RtlSetBits((RTL_BITMAP *)(v2 - 1528), i, v9);
}
v12 = RtlNumberOfSetBits((PRTL_BITMAP)(v2 - 1528));
v10 = v22;
*(_DWORD *)(v2 - 1512) = v12;
*(_DWORD *)(v2 - 1480) = v9;
}
SystemPartition = CmpInitializeActualFileSizes(v2 - 1616, &v23);
if( SystemPartition < 0 )
{
v0 = 64;
goto LABEL_52;
}
if( (int)CmpDoFileSetSizeEx(v2 - 1616, 0i64, v10, 1) < 0 )
CmpCannotWriteConfiguration = 1;
if( v3 )
{
*(_QWORD *)(*(_QWORD *)(v2 - 1552) + 12i64) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
HvCheckAndUpdateHiveBackupTimeStamp(v2 - 1616);
}
if( *(_DWORD *)(*(_QWORD *)(v2 - 1552) + 4092i64) || v3 )
{
RtlSetAllBits((RTL_BITMAP *)(v2 - 1528));
*(_DWORD *)(v2 - 1512) = *(_DWORD *)(v2 - 1528);
}
SystemPartition = HvpDropPagedBins((_HHIVE *)(v2 - 1616));
if( SystemPartition < 0 )
{
v0 = 96;
goto LABEL_52;
}
if( *(_DWORD *)(*(_QWORD *)(v2 - 1552) + 4092i64) || v3 )
{
CmpUnlockRegistry();
CmpFlushHive(v2 - 1616, 12, v13);
CmpLockRegistryExclusive();
*(_DWORD *)(*(_QWORD *)(v2 - 1552) + 4092i64) = 0;
}
if( CmpCannotWriteConfiguration )
CmpDiskFullWarning();
v14 = *(_DWORD *)(v2 - 1456);
*(_DWORD *)(v2 - 1456) = v14 & 0xFFFFF7FF;
CmpUnlockRegistry();
KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
CmpInitCmRM(v2 - 1616, (v14 & 0x800) != 0);
KiUnstackDetachProcess(&ApcState, 0i64);
v15 = *(PKRESOURCEMANAGER **)(v2 + 2576);
*(_DWORD *)(v2 + 2536) |= 8u;
if( v15 )
{
TmEnableCallbacks(v15[7], (PTM_RM_NOTIFICATION)CmKtmNotification, v15);
CmRmFinalizeRecovery(*(_QWORD *)(v2 + 2576));
}
CmpLockRegistryExclusive();
v1 = PoolWithTag;
LABEL_45:
*(_DWORD *)(v2 + 2536) |= 4u;
v2 = *(_QWORD *)v2;
if( (__int64 *)v2 == &CmpPreloadedHivesList )
goto LABEL_3;
}
*(_QWORD *)&Destination_8.Length = 0x10000000i64;
Destination_8.Buffer = v1;
v4 = *(_DWORD *)(v2 - 1456);
if( (v4 & 0x1000) != 0 )
{
v5 = HalSystemVectorDispatchEntry();
Source[0] = *(_WORD *)PsGetServerSiloGlobals(v5)[135];
RtlAppendUnicodeToString(&Destination_8, (PWCHAR)L"\\??\\");
RtlAppendUnicodeToString(&Destination_8, Source);
v6 = L":";
}
else
{
if( (v4 & 0x2000) != 0 )
{
SystemPartition = SyspartGetSystemPartition(v1, 0x1000ui64, (UINT64 *)((char *)&a4 + 4));
if( SystemPartition < 0 )
goto LABEL_52;
goto LABEL_16;
}
if( (v4 & 0x200000) == 0 )
{
LABEL_16:
RtlAppendUnicodeToString(&Destination_8, *(PWCHAR *)(v2 + 208));
goto LABEL_17;
}
v6 = (WCHAR *)L"\\OSDataRoot";
}
RtlAppendUnicodeToString(&Destination_8, v6);
goto LABEL_16;
}
LABEL_3:
ExFreePoolWithTag(v1, 0);
}Referenced by:
CmpFinishSystemHivesLoad