ExpSetPendingUILanguage
NTSTATUS __stdcall ExpSetPendingUILanguage(){
unsigned __int64 v0;
char v1;
char v2;
PVOID *v3;
UINT64 v4;
NTSTATUS result;
WCHAR v6;
int Key;
WCHAR v8;
WCHAR v9;
WCHAR v10;
WCHAR v11;
WCHAR v12;
NTSTATUS InstallUILanguage;
NTSTATUS v14;
WCHAR v15;
unsigned int v16;
unsigned int v17;
UINT64 v18;
void *v19;
VOID *v20;
VOID *v21;
void *v22;
void *v23;
unsigned int v24;
unsigned int v25;
WCHAR v26;
WCHAR v27;
void *v28;
void *v29;
unsigned int v30;
NTSTATUS v31;
__int64 v32;
__int64 v33;
__int64 v34;
WCHAR v35;
WCHAR v36;
void *v37;
_ETHREAD *CurrentThread;
__int64 v39;
UINT64 Length;
PULONG ResultLength;
PULONG ResultLengtha;
PULONG ResultLengthb;
PULONG ResultLengthc;
PULONG ResultLengthd;
char v46;
v0 = (unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64;
*(_DWORD *)(v0 + 68) = 0;
*(_DWORD *)(v0 + 92) = 0;
*(_OWORD *)(v0 + 48) = 0i64;
*(_OWORD *)(v0 + 112) = 0i64;
*(_OWORD *)(v0 + 152) = 0i64;
*(_QWORD *)(v0 + 128) = 0i64;
*(_QWORD *)(v0 + 32) = 0i64;
memset(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 448, 0i64);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 4) = 0;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x90) = 0i64;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88) = 0i64;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10) = 0i64;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28) = 0i64;
v1 = 1;
*(_BYTE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 1) = 1;
v2 = 0;
*(_BYTE *)v0 = 0;
result = OpenGlobalizationUserSettingsKey(v4, v3);
if( result < 0 )
return result;
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"Control Panel\\Desktop", v6);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x80);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
Key = ZwOpenKey((PHANDLE)(v0 + 144), 0x40000000u, (POBJECT_ATTRIBUTES)(v0 + 64));
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = Key;
if( Key < 0 )
goto LABEL_23;
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"PreferredUILanguagesPending", v8);
if( ZwQueryValueKey(
*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x90),
(PUNICODE_STRING)(v0 + 112),
KeyValuePartialInformation,
(PVOID)(v0 + 192),
0x100u,
(PULONG)(v0 + 4)) >= 0 )
{
v24 = *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8);
if( v24 >= 4 && *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC4) == 7 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"PreferredUILanguages", v9);
LODWORD(ResultLength) = v24;
if( ZwSetValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x90),
(UNICODE_STRING *)(v0 + 112),
0i64,
7ui64,
(PVOID)(v0 + 204),
(UINT64)ResultLength) >= 0 )
{
v2 = 1;
*(_BYTE *)v0 = 1;
v25 = *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8);
if( v25 + 12 < 0x100 )
{
*(_WORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 2 * ((unsigned __int64)v25 >> 1) + 0xCA) = 0;
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"PreferredUILanguagesPending", v9);
ZwDeleteValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x90),
(UNICODE_STRING *)(v0 + 112));
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 152), (PCWSTR)(v0 + 204), v26);
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"Control Panel\\Desktop\\LanguageConfigurationPending", v27);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x80);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
if( ZwOpenKey((PHANDLE)(v0 + 136), 0x40000000u, (POBJECT_ATTRIBUTES)(v0 + 64)) >= 0
&& ZwQueryValueKey(
*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88),
(PUNICODE_STRING)(v0 + 152),
KeyValuePartialInformation,
(PVOID)(v0 + 640),
0x210u,
(PULONG)(v0 + 4)) >= 0
&& *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x284) == 7 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"Control Panel\\Desktop\\LanguageConfiguration", v9);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x80);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
LODWORD(ResultLengthc) = 0;
if( ZwCreateKey(
(PVOID *)(v0 + 32),
0x40000000ui64,
(OBJECT_ATTRIBUTES *)(v0 + 64),
0i64,
0i64,
(UINT64)ResultLengthc,
0i64) >= 0 )
{
LODWORD(ResultLengthd) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x288);
if( ZwSetValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20),
(UNICODE_STRING *)(v0 + 152),
0i64,
7ui64,
(PVOID)(v0 + 652),
(UINT64)ResultLengthd) >= 0 )
ZwDeleteValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88),
(UNICODE_STRING *)(v0 + 152));
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20));
}
}
}
}
}
}
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"Control Panel\\Desktop\\MuiCached", v9);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x80);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
ZwOpenKey((PHANDLE)(v0 + 16), 0x40000000u, (POBJECT_ATTRIBUTES)(v0 + 64));
RtlInitUnicodeString(
(PUNICODE_STRING)(v0 + 48),
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings",
v10);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = 0i64;
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
if( ZwOpenKey((PHANDLE)(v0 + 32), 0x80000000, (POBJECT_ATTRIBUTES)(v0 + 64)) < 0 )
{
v28 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10);
if( v28 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"MachinePreferredUILanguages", v11);
ZwDeleteValueKey(v28, (UNICODE_STRING *)(v0 + 112));
}
goto LABEL_15;
}
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"PreferredUILanguages", v11);
if( ZwQueryValueKey(
*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20),
(PUNICODE_STRING)(v0 + 112),
KeyValuePartialInformation,
(PVOID)(v0 + 192),
0x100u,
(PULONG)(v0 + 4)) < 0
|| *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8) < 4u
|| *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC4) != 7 )
{
*(_WORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x18) = 0;
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8) = 0;
InstallUILanguage = NtQueryInstallUILanguage((UINT16 *)(v0 + 24));
if( InstallUILanguage >= 0 )
{
v14 = DownLevelLangIDToLanguageName(
*(_WORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x18),
(PWCHAR)(v0 + 204),
128i64,
0i64);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8) = v14;
if( !v14 )
{
InstallUILanguage = -1073741823;
goto LABEL_55;
}
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8) = 2 * v14;
}
if( InstallUILanguage >= 0 )
goto LABEL_10;
LABEL_55:
DbgPrintEx(
0xFFFFFFFF,
0,
"sysinfo: Can't set MachinePreferredUILanguages due to error %d\n",
(unsigned int)InstallUILanguage);
v29 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10);
if( v29 )
ZwDeleteValueKey(v29, (UNICODE_STRING *)(v0 + 112));
goto LABEL_14;
}
LABEL_10:
if( *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10) )
goto LABEL_12;
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"Control Panel\\Desktop\\MuiCached", v12);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x80);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
LODWORD(ResultLengtha) = 1;
Key = ZwCreateKey(
(PVOID *)(v0 + 16),
0x40000000ui64,
(OBJECT_ATTRIBUTES *)(v0 + 64),
0i64,
0i64,
(UINT64)ResultLengtha,
0i64);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = Key;
if( Key >= 0 )
{
LABEL_12:
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), L"MachinePreferredUILanguages", v12);
LODWORD(ResultLengtha) = *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0xC8);
if( ZwSetValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10),
(UNICODE_STRING *)(v0 + 112),
0i64,
7ui64,
(PVOID)(v0 + 204),
(UINT64)ResultLengtha) < 0 )
DbgPrintEx(0xFFFFFFFF, 0, "sysinfo: Can't set MachinePreferredUILanguages\n");
LABEL_14:
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20));
LABEL_15:
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"MachineLanguageConfiguration", v11);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x10);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
if( ZwOpenKey((PHANDLE)(v0 + 40), 0x40000000u, (POBJECT_ATTRIBUTES)(v0 + 64)) >= 0 )
{
v30 = 0;
do
{
memset(v0 + 192, 0i64);
LODWORD(Length) = 254;
v31 = ZwEnumerateValueKey(
*(VOID **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28),
v30,
KeyValueBasicInformation,
(VOID *)(v0 + 192),
Length,
(UINT64 *)(v0 + 4));
if( v31 >= 0 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), (PCWSTR)(v0 + 204), v15);
if( ZwDeleteValueKey(
*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28),
(UNICODE_STRING *)(v0 + 112)) < 0 )
{
DbgPrint(
"*** MUI: Failed to delete value %S from MachineLanguageConfiguration!\n",
(const wchar_t *)(v0 + 204));
++v30;
}
}
}
while( v31 >= 0 );
}
RtlInitUnicodeString(
(PUNICODE_STRING)(v0 + 48),
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration",
v15);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = 0i64;
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
if( ZwOpenKey((PHANDLE)(v0 + 32), 0x80000000, (POBJECT_ATTRIBUTES)(v0 + 64)) < 0 )
{
Key = 0;
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = 0;
}
else
{
v16 = 0;
do
{
v17 = v16;
memset(v0 + 640, 0i64);
v18 = v16++;
LODWORD(Length) = 526;
Key = ZwEnumerateValueKey(
*(VOID **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20),
v18,
KeyValueFullInformation,
(VOID *)(v0 + 640),
Length,
(UINT64 *)(v0 + 4));
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = Key;
if( Key >= 0 )
{
v32 = *(unsigned int *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x290);
if( (unsigned __int64)(v32 + 24) <= 0x210
&& (v33 = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x288),
v34 = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28C),
(unsigned int)(v33 + v34) <= 0x210)
&& *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x284) == 7
&& *(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x290) < 0xAAu )
{
memset(v0 + 448, 0i64);
memmove((UINT8 *)(v0 + 448), (UINT8 *)(v0 + 660), (unsigned int)v32);
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 112), (PCWSTR)(v0 + 448), v35);
v37 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28);
if( !v37 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v0 + 48), L"MachineLanguageConfiguration", v36);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x40) = 48;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x48) = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 0x10);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x58) = 1600;
*(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x50) = ((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64)
+ 48;
*(_OWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x60) = 0i64;
LODWORD(ResultLengthb) = 1;
Key = ZwCreateKey(
(PVOID *)(v0 + 40),
0x40000000ui64,
(OBJECT_ATTRIBUTES *)(v0 + 64),
0i64,
0i64,
(UINT64)ResultLengthb,
0i64);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = Key;
if( Key < 0 )
goto LABEL_21;
*(_BYTE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 1) = 0;
v37 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28);
v34 = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28C);
v33 = *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x288);
}
LODWORD(ResultLengthb) = v34;
Key = ZwSetValueKey(
v37,
(UNICODE_STRING *)(v0 + 112),
0i64,
7ui64,
(PVOID)((unsigned int)v33 + v0 + 640),
(UINT64)ResultLengthb);
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = Key;
if( Key < 0 )
{
DbgPrint("*** MUI: Can't copy language name for LanguageConfig item %S\n", (const wchar_t *)(v0 + 448));
Key = 0;
*(_DWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 8) = 0;
}
}
else
{
DbgPrint("*** MUI: Can't copy language name for LanguageConfig item %u\n", v17);
}
}
}
while( Key >= 0 );
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x20));
LABEL_21:
v1 = *(_BYTE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 1);
}
v2 = *(_BYTE *)v0;
}
LABEL_23:
v19 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x90);
if( v19 )
ZwClose(v19);
v20 = *(VOID **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88);
if( v20 )
{
LODWORD(Length) = 0;
if( ZwEnumerateValueKey(v20, 0i64, KeyValueBasicInformation, 0i64, Length, (UINT64 *)(v0 + 4)) == -2147483622 )
ZwDeleteKey(*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88));
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x88));
}
if( *(_QWORD *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10) )
{
v21 = *(VOID **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28);
if( !v21
|| v1
&& (LODWORD(Length) = 0,
ZwEnumerateValueKey(v21, 0i64, KeyValueBasicInformation, 0i64, Length, (UINT64 *)(v0 + 4)) == -2147483622) )
{
v22 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28);
if( v22 )
ZwDeleteKey(v22);
LODWORD(Length) = 0;
if( ZwEnumerateValueKey(
*(VOID **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10),
0i64,
KeyValueBasicInformation,
0i64,
Length,
(UINT64 *)(v0 + 4)) == -2147483622 )
ZwDeleteKey(*(PVOID *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10));
}
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x10));
}
v23 = *(void **)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x28);
if( v23 )
ZwClose(v23);
ZwClose(*(HANDLE *)(((unsigned __int64)&v46 & 0xFFFFFFFFFFFFFFE0ui64) + 0x80));
if( v2 == 1 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
v39 = 0i64;
else
v39 = *((_QWORD *)CurrentThread + 30);
if( v39 )
*(_DWORD *)(v39 + 6120) = 0;
}
return Key;
}Referenced by:
NtSetDefaultUILanguage