CmSetAcpiHwProfile
__int64 __fastcall CmSetAcpiHwProfile(
unsigned __int16 *a1,
__int64 (__fastcall *a2)(PVOID, unsigned int *, _QWORD),
__int64 a3,
__int64 a4,
_BYTE *a5){
UINT8 *PoolWithTag;
_QWORD *v7;
int AcpiProfileInformation;
HANDLE v10;
WCHAR v11;
WCHAR v12;
WCHAR v13;
unsigned int v14;
WCHAR v15;
unsigned int v16;
int v17;
WCHAR v18;
__int64 v19;
int v20;
unsigned int v21;
WCHAR v22;
_DWORD *v23;
unsigned int v24;
__int64 v25;
__int64 v26;
_DWORD *v27;
unsigned int v28;
__int64 v29;
__int64 v30;
HANDLE v32;
int v33;
WCHAR v34;
WCHAR v35;
WCHAR v36;
UINT64 Length;
INT8 *ResultLength;
PULONG ResultLengthc;
PULONG ResultLengtha;
PULONG ResultLengthb;
PULONG ResultLengthd;
PULONG Disposition;
INT64 v44;
UINT64 NewProfileNumber;
HANDLE Handle;
struct _UNICODE_STRING DestinationString;
void *KeyHandle;
HANDLE NewProfile;
ULONG v50;
unsigned int v51;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
_QWORD *v53;
PVOID P;
UINT64 v55;
HANDLE Parent;
PVOID v57;
HANDLE v58;
HANDLE a2a;
__int128 a3a;
int KeyValueInformation;
int v62;
unsigned int v63;
SIZE_T NumberOfBytes;
wchar_t Dst[128];
a2a = 0i64;
KeyHandle = 0i64;
PoolWithTag = 0i64;
NewProfile = 0i64;
Handle = 0i64;
v58 = 0i64;
Parent = 0i64;
v7 = (_QWORD *)a4;
v50 = 0;
v51 = 0;
NewProfileNumber = 0i64;
LODWORD(v55) = 0;
v57 = 0i64;
P = 0i64;
*a5 = 0;
v53 = (_QWORD *)a4;
a3a = 0i64;
DestinationString = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
AcpiProfileInformation = CmpOpenDevicesControlSet((INT64)a1, &a2a, &a3a);
if( AcpiProfileInformation < 0 )
goto LABEL_56;
v10 = a2a;
ObjectAttributes.RootDirectory = a2a;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"$&";
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
AcpiProfileInformation = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
if( AcpiProfileInformation < 0 )
{
KeyHandle = 0i64;
}
else
{
AcpiProfileInformation = CmpGetAcpiProfileInformation(
KeyHandle,
(INT64)&P,
(INT64)&v57,
(INT64)Dst,
(INT64)&KeyValueInformation);
if( AcpiProfileInformation < 0 )
goto LABEL_56;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"24";
ObjectAttributes.RootDirectory = v10;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
AcpiProfileInformation = ZwOpenKey(&NewProfile, 0x20019u, &ObjectAttributes);
if( AcpiProfileInformation < 0 )
{
NewProfile = 0i64;
}
else
{
RtlInitUnicodeString(&DestinationString, L"CurrentDockInfo", v11);
ObjectAttributes.RootDirectory = KeyHandle;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
AcpiProfileInformation = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
if( AcpiProfileInformation < 0 )
{
Handle = 0i64;
}
else
{
RtlInitUnicodeString(&DestinationString, L"DockingState", v12);
if( ZwQueryValueKey(Handle, &DestinationString, KeyValueFullInformation, &KeyValueInformation, 0x100u, &v50) >= 0
&& v62 == 4 )
{
v14 = *(int *)((char *)&KeyValueInformation + v63);
RtlInitUnicodeString(&DestinationString, L"AcpiSerialNumber", v13);
if( ZwQueryValueKey(Handle, &DestinationString, KeyValueFullInformation, &KeyValueInformation, 0x100u, &v50) >= 0
&& v62 == 3 )
{
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x20204D43ui64);
if( !PoolWithTag )
{
AcpiProfileInformation = -1073741670;
goto LABEL_56;
}
memmove(PoolWithTag, (UINT8 *)&KeyValueInformation + v63, (unsigned int)NumberOfBytes);
}
RtlInitUnicodeString(&DestinationString, L"CurrentConfig", v15);
if( ZwQueryValueKey(
KeyHandle,
&DestinationString,
KeyValueFullInformation,
&KeyValueInformation,
0x100u,
&v50) >= 0
&& v62 == 4 )
{
v16 = *(int *)((char *)&KeyValueInformation + v63);
AcpiProfileInformation = CmpFilterAcpiDockingState(a1, v14, (INT64)PoolWithTag, v16, (INT64)P, (INT64)v57);
if( AcpiProfileInformation < 0 )
goto LABEL_56;
v17 = a2(P, &v51, 0i64);
AcpiProfileInformation = v17;
if( v51 == -1 )
goto LABEL_22;
if( v17 < 0 )
goto LABEL_56;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"\"$";
ObjectAttributes.RootDirectory = v10;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
AcpiProfileInformation = ZwOpenKey(&Parent, 0x20019u, &ObjectAttributes);
if( AcpiProfileInformation < 0 )
{
Parent = 0i64;
LABEL_22:
v7 = v53;
goto LABEL_23;
}
v19 = 32i64 * v51;
v20 = *(_DWORD *)((char *)P + v19 + 32);
v21 = *(_DWORD *)((char *)P + v19 + 28);
LODWORD(NewProfileNumber) = v21;
if( (v20 & 8) != 0 )
{
Disposition = (PULONG)&KeyValueInformation;
AcpiProfileInformation = CmpMoveBiosAliasTable(KeyHandle, Handle, v16, v21, Dst, ResultLength);
if( AcpiProfileInformation < 0 )
goto LABEL_56;
v21 = NewProfileNumber;
}
if( (v20 & 4) == 0 && v21 == v16 )
goto LABEL_18;
v32 = Handle;
*a5 = 1;
ZwClose(v32);
Handle = 0i64;
if( (v20 & 4) != 0 )
{
v33 = CmpCloneHwProfile(
KeyHandle,
Parent,
NewProfile,
(unsigned int)NewProfileNumber,
*a1,
&NewProfile,
&NewProfileNumber);
}
else
{
ZwClose(NewProfile);
swprintf_s(Dst, 0x80ui64, (WCHAR *)L"%04d");
RtlInitUnicodeString(&DestinationString, Dst, v35);
ObjectAttributes.RootDirectory = Parent;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v33 = ZwOpenKey(&NewProfile, 0x20019u, &ObjectAttributes);
}
AcpiProfileInformation = v33;
if( v33 < 0 )
{
NewProfile = 0i64;
goto LABEL_22;
}
RtlInitUnicodeString(&DestinationString, L"CurrentDockInfo", v34);
ObjectAttributes.RootDirectory = KeyHandle;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Attributes = 576;
LODWORD(ResultLength) = 1;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
AcpiProfileInformation = ZwCreateKey(
&Handle,
0x2001Fui64,
&ObjectAttributes,
0i64,
0i64,
(UINT64)ResultLength,
&v55);
if( AcpiProfileInformation < 0 )
{
Handle = 0i64;
goto LABEL_22;
}
RtlInitUnicodeString(&DestinationString, L"CurrentConfig", v36);
LODWORD(ResultLengthb) = 4;
if( ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &NewProfileNumber, (UINT64)ResultLengthb) >= 0 )
{
LABEL_18:
HIDWORD(NewProfileNumber) = *a1;
RtlInitUnicodeString(&DestinationString, L"DockingState", v18);
LODWORD(ResultLength) = 4;
ZwSetValueKey(
Handle,
&DestinationString,
0i64,
4ui64,
(char *)&NewProfileNumber + 4,
(UINT64)ResultLength);
RtlInitUnicodeString(&DestinationString, L"AcpiSerialNumber", v22);
LODWORD(ResultLengthc) = a1[1];
AcpiProfileInformation = ZwSetValueKey(
Handle,
&DestinationString,
0i64,
3ui64,
a1 + 2,
(UINT64)ResultLengthc);
if( (v20 & 2) == 0 )
AcpiProfileInformation = CmpAddAcpiAliasEntry(
KeyHandle,
a1,
(unsigned int)NewProfileNumber,
Dst,
Length,
ResultLengtha,
(INT64)Disposition,
v44);
if( (_DWORD)NewProfileNumber != v16 )
{
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"24";
ObjectAttributes.RootDirectory = v10;
LODWORD(ResultLengtha) = 8;
ObjectAttributes.Attributes = 832;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ZwCreateKey(&v58, 0x20ui64, &ObjectAttributes, 0i64, 0i64, (UINT64)ResultLengtha, &v55);
*(_QWORD *)&DestinationString.Length = 0x1000000i64;
DestinationString.Buffer = Dst;
RtlUnicodeStringPrintf(
&DestinationString,
L"\\Registry\\Machine\\%wZ\\CurrentControlSet\\Hardware Profiles\\%04d",
&a3a,
(unsigned int)NewProfileNumber);
LODWORD(ResultLengthd) = DestinationString.Length;
AcpiProfileInformation = ZwSetValueKey(
v58,
&CmSymbolicLinkValueName,
0i64,
6ui64,
DestinationString.Buffer,
(UINT64)ResultLengthd);
}
goto LABEL_22;
}
}
AcpiProfileInformation = -1073741492;
goto LABEL_56;
}
AcpiProfileInformation = -1073741492;
}
}
}
LABEL_23:
if( AcpiProfileInformation >= 0 )
{
*v7 = NewProfile;
goto LABEL_25;
}
LABEL_56:
if( NewProfile )
ZwClose(NewProfile);
LABEL_25:
if( v58 )
ZwClose(v58);
if( KeyHandle )
ZwClose(KeyHandle);
if( Handle )
ZwClose(Handle);
if( Parent )
ZwClose(Parent);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
v23 = P;
if( P )
{
v24 = 0;
HIDWORD(NewProfileNumber) = 0;
if( *((_DWORD *)P + 1) )
{
v25 = 0i64;
do
{
v26 = 8 * v25;
if( *(_QWORD *)&v23[v26 + 4] )
{
ExFreePoolWithTag(*(PVOID *)&v23[v26 + 4], 0);
v24 = HIDWORD(NewProfileNumber);
v23 = P;
}
HIDWORD(NewProfileNumber) = ++v24;
v25 = v24;
}
while( v24 < v23[1] );
}
ExFreePoolWithTag(v23, 0);
}
v27 = v57;
if( v57 )
{
v28 = 0;
HIDWORD(NewProfileNumber) = 0;
if( *((_DWORD *)v57 + 1) )
{
v29 = 0i64;
do
{
v30 = 3 * (v29 + 1);
if( *(_QWORD *)&v27[2 * v30] )
{
ExFreePoolWithTag(*(PVOID *)&v27[2 * v30], 0);
v28 = HIDWORD(NewProfileNumber);
v27 = v57;
}
HIDWORD(NewProfileNumber) = ++v28;
v29 = v28;
}
while( v28 < v27[1] );
}
ExFreePoolWithTag(v27, 0);
}
return(unsigned int)AcpiProfileInformation;
}Referenced by:
CmpCreateHardwareProfiles
IopExecuteHardwareProfileChange