ExpWatchProductTypeWork
VOID __stdcall ExpWatchProductTypeWork(VOID *Context){
char v1;
char v2;
char v3;
VOID *v4;
int v5;
NTSTATUS v6;
_KSPIN_LOCK *v7;
const wchar_t *v8;
int v9;
int v10;
const wchar_t *v11;
int v12;
int v13;
char v14;
const wchar_t *v15;
char *v16;
int v17;
int v18;
unsigned __int16 v19;
int v20;
__int64 v21;
int v22;
struct _EXP_LICENSE_STATE *ExpLicenseState;
NTSTATUS v24;
unsigned int *v25;
_OBJECT_TYPE *v26;
NTSTATUS v27;
unsigned int v28;
void *v29;
__int64 v30;
UINT64 Length;
UINT64 Lengtha;
UINT64 *ResultLength;
UINT64 *ResultLengtha;
UINT64 *ResultLengthb;
_LARGE_INTEGER Interval;
UINT64 v37;
_UNICODE_STRING ValueName;
VOID *v39;
VOID *Handle;
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES v42;
__int128 KeyValueInformation[2];
__int16 v44;
*(_QWORD *)&v42.Length = 48i64;
*(_QWORD *)&v42.Attributes = 576i64;
Handle = 0i64;
DestinationString = 0i64;
LODWORD(v37) = 0;
v1 = 1;
v39 = 0i64;
ValueName = 0i64;
v2 = 0;
v3 = 0;
v4 = 0i64;
RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions");
v42.RootDirectory = 0i64;
v42.ObjectName = &DestinationString;
*(_OWORD *)&v42.SecurityDescriptor = 0i64;
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 40, 0i64);
if( *(&ExBootDevicesRemovedEvent + 38) )
{
while( 1 )
{
v5 = CmOpenKey(&v39, 131103, &v42, 0, 0i64);
if( v5 != -1073741670 )
break;
Interval.QuadPart = -10000000i64;
KeDelayExecutionThread(0, 0, &Interval);
}
if( v5 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0xD, (PVOID)(unsigned int)v5, 0i64, 0i64);
v4 = (VOID *)*(&ExBootDevicesRemovedEvent + 38);
*(&ExBootDevicesRemovedEvent + 38) = v39;
if( !ExpSetupModeDetected )
{
RtlInitUnicodeString(&ValueName, L"ProductType");
LODWORD(Length) = 34;
v6 = NtQueryValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
Length,
&v37);
if( v6 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(Lengtha) = 34;
v6 = NtQueryValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
Lengtha,
&v37);
}
while( v6 == -1073741670 );
}
if( v6 >= 0 )
{
v8 = L"LanmanNT";
do
{
v9 = *(const wchar_t *)((char *)v8 + (char *)KeyValueInformation + 12 - (char *)L"LanmanNT");
v10 = *v8 - v9;
if( v10 )
break;
++v8;
}
while( v9 );
if( !v10 )
goto LABEL_48;
v11 = L"ServerNT";
do
{
v12 = *(const wchar_t *)((char *)v11 + (char *)KeyValueInformation + 12 - (char *)L"ServerNT");
v13 = *v11 - v12;
if( v13 )
break;
++v11;
}
while( v12 );
v14 = 0;
if( !v13 )
LABEL_48:
v14 = 1;
v15 = L"WinNT";
v16 = (char *)(*(&ExBootDevicesRemovedEvent + 25) + 12i64);
do
{
v17 = *(const wchar_t *)((char *)v15 + *(&ExBootDevicesRemovedEvent + 25) + 12i64 - (_QWORD)L"WinNT");
v18 = *v15 - v17;
if( v18 )
break;
++v15;
}
while( v17 );
if( v18 && v14 )
{
v30 = *(&ExBootDevicesRemovedEvent + 25);
v1 = 0;
**(&ExBootDevicesRemovedEvent + 25) = KeyValueInformation[0];
*(_OWORD *)(v30 + 16) = KeyValueInformation[1];
*(_WORD *)(v30 + 32) = v44;
}
v7 = (_KSPIN_LOCK *)((char *)KeyValueInformation + 12 - v16);
while( 1 )
{
v19 = *(_WORD *)v16;
if( *(_WORD *)v16 != *(_WORD *)((char *)v7 + (_QWORD)v16) )
break;
v16 += 2;
if( !v19 )
{
v20 = 0;
goto LABEL_23;
}
}
v20 = v19 < *(_WORD *)((char *)v7 + (_QWORD)v16) ? -1 : 1;
LABEL_23:
v1 = v20 != 0 ? v1 : 0;
}
v21 = *(&ExBootDevicesRemovedEvent + 38);
v22 = -1073741822;
ExpLicenseState = PsGetCurrentServerSiloGlobals(v7)->ExpLicenseState;
if( !qword_140D2C4F8 || (v22 = qword_140D2C4F8(ExpLicenseState, v21), v22 < 0) )
KeBugCheckEx(0x9Au, (PVOID)0x11, (PVOID)(unsigned int)v22, (PVOID)1, 0i64);
CmpLockRegistryFreezeAware(1u);
v2 = 1;
LODWORD(ResultLength) = *(_DWORD *)(*(&ExBootDevicesRemovedEvent + 25) + 8i64);
v24 = NtSetValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
0i64,
*(unsigned int *)(*(&ExBootDevicesRemovedEvent + 25) + 4i64),
(VOID *)(*(&ExBootDevicesRemovedEvent + 25) + 12i64),
(UINT64)ResultLength);
if( v24 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(ResultLengtha) = *(_DWORD *)(*(&ExBootDevicesRemovedEvent + 25) + 8i64);
v24 = NtSetValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
0i64,
*(unsigned int *)(*(&ExBootDevicesRemovedEvent + 25) + 4i64),
(VOID *)(*(&ExBootDevicesRemovedEvent + 25) + 12i64),
(UINT64)ResultLengtha);
}
while( v24 == -1073741670 );
}
if( v24 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x11, (PVOID)(unsigned int)v24, (PVOID)1, 0i64);
v25 = (unsigned int *)qword_140C53FE0;
RtlInitUnicodeString(&ValueName, L"ProductSuite");
if( v25 )
{
LODWORD(ResultLengtha) = v25[2];
v27 = NtSetValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
0i64,
v25[1],
v25 + 3,
(UINT64)ResultLengtha);
if( v27 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(ResultLengthb) = *((_DWORD *)qword_140C53FE0 + 2);
v27 = NtSetValueKey(
*(&ExBootDevicesRemovedEvent + 38),
&ValueName,
0i64,
*((unsigned int *)qword_140C53FE0 + 1),
(char *)qword_140C53FE0 + 12,
(UINT64)ResultLengthb);
}
while( v27 == -1073741670 );
}
if( v27 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x11, (PVOID)(unsigned int)v27, (PVOID)2, 0i64);
}
else
{
NtDeleteValueKey(*(&ExBootDevicesRemovedEvent + 38), &ValueName, v26);
}
}
while( 1 )
{
v28 = NtNotifyChangeKey(
*(&ExBootDevicesRemovedEvent + 76),
0,
(PIO_APC_ROUTINE)((char *)&ExBootDevicesRemovedEvent + 256),
(PVOID)1,
(PIO_STATUS_BLOCK)&ExBootDevicesRemovedEvent + 18,
0x10000005u,
0,
(char *)&ExBootDevicesRemovedEvent + 208,
4u,
1u);
v29 = (void *)v28;
if( v28 != -1073741670 )
break;
Interval.QuadPart = -10000000i64;
KeDelayExecutionThread(0, 0, &Interval);
}
if( v2 )
CmpUnlockRegistry();
if( (int)v29 < 0 )
KeBugCheckEx(0x9Au, (PVOID)0x11, v29, (PVOID)4, 0i64);
v3 = v2;
if( !ExpSetupModeDetected
&& v1
&& (int)PsCreateSystemThreadEx(
(__int64)&Handle,
0x1FFFFF,
0i64,
0i64,
0i64,
ExpExpirationThread,
3221226090i64,
0i64,
0i64) >= 0 )
{
ZwClose((_HANDLE)Handle);
}
}
ExReleasePushLockEx((ULONG_PTR)&ExBootDevicesRemovedEvent + 320, 0);
if( v4 )
{
if( v3 )
NtFlushKey(v4);
ObCloseHandle(v4, 0);
}
}Referenced by:
No references.