CmpFinishSystemHivesLoad
void __fastcall CmpFinishSystemHivesLoad(PRKEVENT Event){
char v2;
UINT64 *v3;
UINT64 v4;
const wchar_t *v5;
__int64 v6;
__int16 v7;
signed __int64 v8;
__int16 Buffer;
_KWAIT_BLOCK *v10;
UINT8 v11;
VOID **v12;
char *v13;
VOID **v14;
__int64 v15;
char v16;
char *v17;
unsigned int i;
WCHAR *v19;
INT64 v20;
int v21;
_QWORD *v22;
_QWORD *v23;
PVOID v24;
INT64 v25;
INT64 v26;
_WCHAR *v27;
_WCHAR *v28;
unsigned int v29;
char *v30;
char v31;
unsigned int v32;
_EX_PUSH_LOCK *v33;
INT64 v34;
_UNICODE_STRING *Timeout;
PLARGE_INTEGER Timeouta;
WCHAR **Alertable;
UINT64 Alertablea;
_LARGE_INTEGER *v39;
_KWAIT_BLOCK *WaitBlockArray;
_UNICODE_STRING DestinationString;
char *v42;
UINT64 pcchDest;
WCHAR *ppszDest;
VOID *KeyHandle;
PVOID P;
PPRIVILEGE_SET Privileges;
PPRIVILEGE_SET TransientPoolWithTag;
_OBJECT_ATTRIBUTES ObjectAttributes;
_KAPC_STATE ApcState;
char HiveLoadFailure[432];
char v52;
v2 = 0;
KeyHandle = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset(&ApcState, 0, sizeof(ApcState));
memset(HiveLoadFailure, 0i64, sizeof(HiveLoadFailure));
qword_140C50830 = (__int64)KeGetCurrentThread();
BYTE1(NlsMbCodePageTag) = 0;
DestinationString.Buffer = (wchar_t *)0x800000;
ppszDest = 0i64;
pcchDest = 0i64;
v42 = &v52;
if( RtlUnicodeStringValidateDestWorker(
(_UNICODE_STRING *)&DestinationString.Buffer,
&ppszDest,
&pcchDest,
v3,
Timeout,
Alertable,
(UINT64 *)&v39->QuadPart,
(UINT64)WaitBlockArray) < 0 )
{
Buffer = (__int16)DestinationString.Buffer;
}
else
{
v4 = pcchDest;
v5 = L"\\REGISTRY\\";
v6 = 0x7FFFi64;
v7 = 0;
if( pcchDest )
{
v8 = (char *)ppszDest - (char *)L"\\REGISTRY\\";
do
{
if( !v6 )
break;
if( !*v5 )
break;
*(const wchar_t *)((char *)v5 + v8) = *v5;
--v6;
++v5;
++v7;
}
while( v6 + v4 - 0x7FFF );
}
Buffer = 2 * v7;
LOWORD(DestinationString.Buffer) = Buffer;
}
Privileges = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithTag(0x200ui64, 0x150ui64);
v10 = (_KWAIT_BLOCK *)Privileges;
if( !Privileges )
KeBugCheckEx(0x74u, (PVOID)2, (PVOID)4, 0i64, (PVOID)0xFFFFFFFFC000009Ai64);
TransientPoolWithTag = (PPRIVILEGE_SET)CmpAllocateTransientPoolWithTag(0x200ui64, 0x38ui64);
v12 = (VOID **)TransientPoolWithTag;
if( !TransientPoolWithTag )
KeBugCheckEx(0x74u, (PVOID)2, (PVOID)6, 0i64, (PVOID)0xFFFFFFFFC000009Ai64);
P = CmpHiveRootSecurityDescriptor(v11);
v13 = (char *)&stru_140C00F40 + 24;
v14 = v12;
v15 = 7i64;
do
{
*v14 = v13;
v13 += 200;
++v14;
--v15;
}
while( v15 );
if( !Event )
{
KeWaitForSingleObject((UINT64)&stru_140C00F40 + 624, 0, 0, 0, 0i64);
KeSetEvent((PRKEVENT)((char *)&stru_140C00F40 + 624), 0, 0);
KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
CmpInitCmRM(0i64, NeedRmLogStart);
KiUnstackDetachProcess(&ApcState, 0i64);
if( CmRmSystem )
{
TmEnableCallbacks(*((PKRESOURCEMANAGER *)CmRmSystem + 7), (PTM_RM_NOTIFICATION)CmKtmNotification, CmRmSystem);
CmRmFinalizeRecovery((CM_RM *)CmRmSystem);
}
}
while( 2 )
{
KeWaitForMultipleObjects(7ui64, v12, WaitAny, Executive, 0, 0, 0i64, v10);
v16 = 0;
v17 = (char *)&unk_140C00F30;
for( i = 0; i < 7; ++i )
{
if( v17[8] )
goto LABEL_54;
if( !v17[9] )
{
v16 = 1;
goto LABEL_54;
}
v19 = (WCHAR *)*((_QWORD *)v17 - 5);
LOWORD(DestinationString.Buffer) = Buffer;
RtlAppendUnicodeToString((_UNICODE_STRING *)&DestinationString.Buffer, v19);
RtlAppendUnicodeToString((_UNICODE_STRING *)&DestinationString.Buffer, *((WCHAR **)v17 - 4));
CmpLockRegistryExclusive();
if( !*((_QWORD *)v17 - 3) )
{
if( !*(_QWORD *)v17 )
goto LABEL_32;
LOBYTE(v20) = v17[11];
LODWORD(Timeouta) = *((_DWORD *)v17 - 2);
v21 = CmpLinkHiveToMaster(
(_UNICODE_STRING *)&DestinationString.Buffer,
0i64,
*(_CMHIVE **)v17,
v20,
(UINT64)Timeouta,
0,
0i64,
P,
0i64,
0i64,
1u);
if( v21 < 0 )
{
if( (*(&CmpDummyThreadEvent + 1056) & 1) == 0 )
KeBugCheckEx(0x73u, (PVOID)1, (PVOID)v21, (PVOID)i, &DestinationString.Buffer);
byte_140C5082C = 0;
qword_140C50830 = 0i64;
CmpUnlockRegistry();
v29 = 0;
v30 = (char *)&unk_140C00F38;
do
{
if( *((_DWORD *)v30 + 3) && !*v30 )
{
if( !v30[1] )
KeWaitForSingleObject((UINT64)(v30 + 32), 0, 0, 0, 0i64);
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v30 + 10, 0i64);
KeSetEvent((PRKEVENT)(v30 + 56), 0, 0);
CmpNotifyMachineHiveLoaded(v29);
ExReleasePushLockEx((_DWORD)v30 + 80, 0);
}
++v29;
v30 += 200;
}
while( v29 < 7 );
goto LABEL_80;
}
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 340, 0i64);
v22 = (_QWORD *)qword_140D2D918;
v23 = (_QWORD *)(*(_QWORD *)v17 + 1600i64);
if( *(__int64 **)qword_140D2D918 != &CmpHiveListHead )
__fastfail(3u);
*v23 = &CmpHiveListHead;
v23[1] = v22;
*v22 = v23;
qword_140D2D918 = (__int64)v23;
ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2720, 0);
CmpRecheckHiveVolumePolicy(*(_QWORD *)v17);
if( v17[11] )
{
*(_DWORD *)(*(_QWORD *)v17 + 160i64) |= 0x20u;
*(_QWORD *)(*(_QWORD *)v17 + 4208i64) = KeGetCurrentThread();
CmpUnlockRegistry();
CmpFlushHive(*(CMHIVE **)v17, 4ui64);
CmpLockRegistryExclusive();
*(_DWORD *)(*(_QWORD *)v17 + 160i64) &= ~0x20u;
*(_QWORD *)(*(_QWORD *)v17 + 4208i64) = 0i64;
}
v24 = CmRmSystem;
if( CmRmSystem && (*(_DWORD *)(*(_QWORD *)v17 + 160i64) & 2) == 0 && !*(_QWORD *)(*(_QWORD *)v17 + 4192i64) )
{
++*((_DWORD *)CmRmSystem + 16);
*(_QWORD *)(*(_QWORD *)v17 + 4192i64) = v24;
}
}
if( *(_QWORD *)v17 )
CmpAddToHiveFileList(*(_CMHIVE **)v17);
LABEL_32:
v17[8] = 1;
if( i != 3 )
{
switch( i )
{
case 2u:
CmpUnlockRegistry();
if( !Event )
{
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v17 + 11, 0i64);
KeSetEvent((PRKEVENT)(v17 + 64), 0, 0);
v2 = 1;
CmpNotifyMachineHiveLoaded(2ui64);
ExReleasePushLockEx((_DWORD)v17 + 88, 0);
if( *(&stru_140C00F40 + 592) && CmFastBoot )
{
ExpRefreshSystemTime(v26);
PsBootPhaseComplete();
}
CmpSetVersionData();
}
CmpCreatePerfKeys();
goto LABEL_50;
case 1u:
v27 = L"\\Registry\\Machine\\SAM\\SAM";
v28 = L"\\Registry\\Machine\\Security\\SAM";
break;
case 4u:
v27 = (_WCHAR *)L"\\Registry\\User\\.Default";
v28 = (_WCHAR *)L"\\Registry\\User\\S-1-5-18";
break;
default:
LABEL_49:
CmpUnlockRegistry();
LABEL_50:
if( !Event && !v2 )
{
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v17 + 11, 0i64);
KeSetEvent((PRKEVENT)(v17 + 64), 0, 0);
CmpNotifyMachineHiveLoaded(i);
ExReleasePushLockEx((_DWORD)v17 + 88, 0);
}
goto LABEL_53;
}
CmpLinkKeyToHive(v28, v27);
goto LABEL_49;
}
if( Event )
goto LABEL_49;
CmpMountPreloadedHives();
CmpInterlockedFunction();
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v17 + 11, 0i64);
KeSetEvent((PRKEVENT)(v17 + 64), 0, 0);
v2 = 1;
CmpNotifyMachineHiveLoaded(3ui64);
ExReleasePushLockEx((_DWORD)v17 + 88, 0);
if( !*(&stru_140C00F40 + 392) || !CmFastBoot )
goto LABEL_49;
CmpUnlockRegistry();
ExpRefreshSystemTime(v25);
PsBootPhaseComplete();
LABEL_53:
v2 = 0;
LABEL_54:
v17 += 200;
}
if( v16 )
{
v12 = (VOID **)TransientPoolWithTag;
v10 = (_KWAIT_BLOCK *)Privileges;
continue;
}
break;
}
CmpLockRegistryExclusive();
CmpSpecialBootCondition = 0;
if( BYTE4(NlsMbCodePageTag) || (v31 = 1, CmVEEnabled != 1) )
v31 = 0;
CmpVEEnabled = v31;
CmpUnlockRegistry();
if( Event )
{
KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
CmpInitCmRM(0i64, NeedRmLogStart);
KiUnstackDetachProcess(&ApcState, 0i64);
if( CmRmSystem )
{
TmEnableCallbacks(*((PKRESOURCEMANAGER *)CmRmSystem + 7), (PTM_RM_NOTIFICATION)CmKtmNotification, CmRmSystem);
CmRmFinalizeRecovery((CM_RM *)CmRmSystem);
}
CmpLockRegistryExclusive();
CmpMountPreloadedHives();
CmpInterlockedFunction();
CmpUnlockRegistry();
v32 = 0;
v33 = (_EX_PUSH_LOCK *)((char *)&stru_140C00F40 + 72);
do
{
ExAcquirePushLockExclusiveEx(v33, 0i64);
KeSetEvent((PRKEVENT)&v33[-3], 0, 0);
CmpNotifyMachineHiveLoaded(v32);
ExReleasePushLockEx((ULONG_PTR)v33, 0);
++v32;
v33 += 25;
}
while( v32 < 7 );
if( CmFastBoot )
{
ExpRefreshSystemTime(v34);
PsBootPhaseComplete();
}
CmpSetVersionData();
}
LODWORD(Alertablea) = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&CmpConfigurationManagerKeyName;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwCreateKey(&KeyHandle, 2ui64, &ObjectAttributes, 0i64, 0i64, Alertablea, 0i64) >= 0 )
ZwClose((_HANDLE)KeyHandle);
LABEL_80:
CmpSpecialBootCondition = 0;
byte_140C5082C = 0;
qword_140C50830 = 0i64;
if( Event )
KeSetEvent(Event, 0, 0);
if( P )
ExFreePoolWithTag(P, 0);
CmSiFreeMemory(Privileges);
CmSiFreeMemory(TransientPoolWithTag);
}Referenced by:
No references.