ExpWatchProductTypeWork
VOID __fastcall ExpWatchProductTypeWork(VOID *Context){
WCHAR v1;
char v2;
char v3;
char v4;
HANDLE v5;
int v6;
WCHAR v7;
int v8;
const wchar_t *v9;
int v10;
int v11;
const wchar_t *v12;
int v13;
int v14;
char v15;
const wchar_t *v16;
char *v17;
int v18;
int v19;
char *v20;
unsigned __int16 v21;
int v22;
HANDLE v23;
int v24;
__int64 v25;
NTSTATUS v26;
WCHAR v27;
unsigned int *v28;
NTSTATUS v29;
unsigned int v30;
ULONG_PTR v31;
__int64 v32;
UINT64 Length;
UINT64 Lengtha;
PULONG ResultLength;
PULONG ResultLengtha;
PULONG ResultLengthb;
PULONG ResultLengthc;
INT64 Asynchroneous;
PVOID ChangeBuffer;
BOOL WatchSubtree;
union _LARGE_INTEGER Interval;
UINT64 v43;
struct _UNICODE_STRING ValueName;
VOID *KeyHandle;
HANDLE Handle;
struct _UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int128 KeyValueInformation[2];
__int16 v50;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
Handle = 0i64;
DestinationString = 0i64;
LODWORD(v43) = 0;
v2 = 1;
KeyHandle = 0i64;
ValueName = 0i64;
v3 = 0;
v4 = 0;
v5 = 0i64;
RtlInitUnicodeString(
&DestinationString,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions",
v1);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ExAcquirePushLockSharedEx((UINT64)&ExpKeyManipLock, 0i64);
if( ExpProductTypeKey )
{
while( 1 )
{
v6 = CmOpenKey(
&KeyHandle,
131103i64,
&ObjectAttributes,
0i64,
0i64,
(INT64)ResultLength,
Asynchroneous,
(INT64)ChangeBuffer);
if( v6 != -1073741670 )
break;
Interval.QuadPart = -10000000i64;
KeDelayExecutionThread(0, 0, &Interval);
}
if( v6 < 0 )
KeBugCheckEx(0x9Au, 0xDui64, (unsigned int)v6, 0i64, 0i64);
v5 = ExpProductTypeKey;
ExpProductTypeKey = KeyHandle;
if( !ExpSetupModeDetected )
{
RtlInitUnicodeString(&ValueName, L"ProductType", v7);
LODWORD(Length) = 34;
v8 = NtQueryValueKey(ExpProductTypeKey, &ValueName, KeyValuePartialInformation, KeyValueInformation, Length, &v43);
if( v8 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(Lengtha) = 34;
v8 = NtQueryValueKey(
ExpProductTypeKey,
&ValueName,
KeyValuePartialInformation,
KeyValueInformation,
Lengtha,
&v43);
}
while( v8 == -1073741670 );
}
if( v8 >= 0 )
{
v9 = L"LanmanNT";
do
{
v10 = *(const wchar_t *)((char *)v9 + (char *)KeyValueInformation + 12 - (char *)L"LanmanNT");
v11 = *v9 - v10;
if( v11 )
break;
++v9;
}
while( v10 );
if( !v11 )
goto LABEL_48;
v12 = L"ServerNT";
do
{
v13 = *(const wchar_t *)((char *)v12 + (char *)KeyValueInformation + 12 - (char *)L"ServerNT");
v14 = *v12 - v13;
if( v14 )
break;
++v12;
}
while( v13 );
v15 = 0;
if( !v14 )
LABEL_48:
v15 = 1;
v16 = L"WinNT";
v17 = (char *)(*(_QWORD *)ExpProductTypeValueInfo + 12i64);
do
{
v18 = *(const wchar_t *)((char *)v16 + *(_QWORD *)ExpProductTypeValueInfo + 12i64 - (_QWORD)L"WinNT");
v19 = *v16 - v18;
if( v19 )
break;
++v16;
}
while( v18 );
if( v19 && v15 )
{
v32 = *(_QWORD *)ExpProductTypeValueInfo;
v2 = 0;
*(_OWORD *)ExpProductTypeValueInfo = KeyValueInformation[0];
*(_OWORD *)(v32 + 16) = KeyValueInformation[1];
*(_WORD *)(v32 + 32) = v50;
}
v20 = (char *)((char *)KeyValueInformation + 12 - v17);
while( 1 )
{
v21 = *(_WORD *)v17;
if( *(_WORD *)v17 != *(_WORD *)&v20[(_QWORD)v17] )
break;
v17 += 2;
if( !v21 )
{
v22 = 0;
goto LABEL_23;
}
}
v22 = v21 < *(_WORD *)&v20[(_QWORD)v17] ? -1 : 1;
LABEL_23:
v2 = v22 != 0 ? v2 : 0;
}
v23 = ExpProductTypeKey;
v24 = -1073741822;
v25 = PsGetCurrentServerSiloGlobals()[113];
if( !qword_140D2C4F8 || (v24 = qword_140D2C4F8(v25, v23), v24 < 0) )
KeBugCheckEx(0x9Au, 0x11ui64, (unsigned int)v24, 1ui64, 0i64);
CmpLockRegistryFreezeAware(1u);
v3 = 1;
LODWORD(ResultLengtha) = *(_DWORD *)(*(_QWORD *)ExpProductTypeValueInfo + 8i64);
v26 = NtSetValueKey(
ExpProductTypeKey,
&ValueName,
0i64,
*(unsigned int *)(*(_QWORD *)ExpProductTypeValueInfo + 4i64),
(VOID *)(*(_QWORD *)ExpProductTypeValueInfo + 12i64),
(UINT64)ResultLengtha);
if( v26 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(ResultLengthb) = *(_DWORD *)(*(_QWORD *)ExpProductTypeValueInfo + 8i64);
v26 = NtSetValueKey(
ExpProductTypeKey,
&ValueName,
0i64,
*(unsigned int *)(*(_QWORD *)ExpProductTypeValueInfo + 4i64),
(VOID *)(*(_QWORD *)ExpProductTypeValueInfo + 12i64),
(UINT64)ResultLengthb);
}
while( v26 == -1073741670 );
}
if( v26 < 0 )
KeBugCheckEx(0x9Au, 0x11ui64, (unsigned int)v26, 1ui64, 0i64);
v28 = (unsigned int *)qword_140C53FE0;
RtlInitUnicodeString(&ValueName, L"ProductSuite", v27);
if( v28 )
{
LODWORD(ResultLengthb) = v28[2];
v29 = NtSetValueKey(ExpProductTypeKey, &ValueName, 0i64, v28[1], v28 + 3, (UINT64)ResultLengthb);
if( v29 == -1073741670 )
{
Interval.QuadPart = -10000000i64;
do
{
KeDelayExecutionThread(0, 0, &Interval);
LODWORD(ResultLengthc) = *((_DWORD *)qword_140C53FE0 + 2);
v29 = NtSetValueKey(
ExpProductTypeKey,
&ValueName,
0i64,
*((unsigned int *)qword_140C53FE0 + 1),
(char *)qword_140C53FE0 + 12,
(UINT64)ResultLengthc);
}
while( v29 == -1073741670 );
}
if( v29 < 0 )
KeBugCheckEx(0x9Au, 0x11ui64, (unsigned int)v29, 2ui64, 0i64);
}
else
{
NtDeleteValueKey(ExpProductTypeKey, &ValueName);
}
}
while( 1 )
{
LOBYTE(WatchSubtree) = 1;
LOBYTE(Asynchroneous) = 0;
v30 = NtNotifyChangeKey(
ExpProductTypeKey,
0i64,
ExpWatchProductTypeWorkItem,
(PVOID)1,
&ExpProductTypeIoSb,
0x10000005u,
Asynchroneous,
ExpProductTypeChangeBuffer,
4u,
WatchSubtree);
v31 = v30;
if( v30 != -1073741670 )
break;
Interval.QuadPart = -10000000i64;
KeDelayExecutionThread(0, 0, &Interval);
}
if( v3 )
CmpUnlockRegistry();
if( (v31 & 0x80000000) != 0i64 )
KeBugCheckEx(0x9Au, 0x11ui64, v31, 4ui64, 0i64);
v4 = v3;
if( !ExpSetupModeDetected
&& v2
&& PsCreateSystemThreadEx(
&Handle,
0x1FFFFFui64,
0i64,
0i64,
0i64,
ExpExpirationThread,
(PVOID)0xC000026Ai64,
0i64,
0i64) >= 0 )
{
ZwClose(Handle);
}
}
ExReleasePushLockEx((UINT64)&ExpKeyManipLock, 0i64);
if( v5 )
{
if( v4 )
NtFlushKey(v5);
ObCloseHandle(v5, 0);
}
}Referenced by:
No references.