CmpFindControlSet
__int64 __fastcall CmpFindControlSet(PVOID BugCheckParameter3, __int64 a2, __int64 a3, _BYTE *a4){
unsigned int v6;
__int64(__fastcall *v7)(PVOID, __int64, int *);
_CM_KEY_NODE *v9;
__int64 v10;
unsigned int ValueByName;
__int64 v12;
unsigned int v13;
_CM_KEY_VALUE *v14;
_CELL_DATA *v15;
__int64 v16;
NTSTATUS v17;
PVOID v18;
_CM_KEY_NODE *v19;
__int64 v20;
unsigned int v21;
_CM_KEY_VALUE *v22;
_CELL_DATA *v23;
_CM_KEY_VALUE *v25;
_CELL_DATA *v26;
_HV_GET_CELL_CONTEXT *p_CellContext;
UINT Cell;
int v29[2];
_HV_GET_CELL_CONTEXT CellContext;
int v31[2];
UINT realsize;
UINT v33;
_UNICODE_STRING DestinationString;
_HV_GET_CELL_CONTEXT v35;
_HV_GET_CELL_CONTEXT v36;
_STRING SourceString;
char Dst[128];
char v39;
realsize = 0;
v31[1] = 0;
*(_DWORD *)&CellContext.BinContext._bf_0 = 0;
*(_DWORD *)&v36.BinContext._bf_0 = 0;
v29[1] = 0;
*(_DWORD *)&v35.BinContext._bf_0 = 0;
v6 = a2;
v7 = (__int64(__fastcall *)(PVOID, __int64, int *))*((_QWORD *)BugCheckParameter3 + 1);
DestinationString = 0i64;
v31[0] = -1;
SourceString = 0i64;
CellContext.Cell = -1;
v36.Cell = -1;
v29[0] = -1;
v35.Cell = -1;
v9 = (_CM_KEY_NODE *)v7(BugCheckParameter3, a2, v29);
if( !v9 )
return 0xFFFFFFFFi64;
RtlInitUnicodeString(&DestinationString, L"select");
Cell = 0;
CmpFindSubKeyByNameWithStatus((_HHIVE *)BugCheckParameter3, v9, &DestinationString, &Cell);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v29);
if( Cell == -1 )
return 0xFFFFFFFFi64;
v10 = (*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(BugCheckParameter3, Cell, v29);
if( !v10 )
return 0xFFFFFFFFi64;
RtlInitUnicodeString(&DestinationString, L"AutoSelect");
ValueByName = CmpFindValueByName((__int64)BugCheckParameter3, v10, (__int64)&DestinationString);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v29);
if( ValueByName == -1 )
{
*a4 = 1;
}
else
{
v25 = (_CM_KEY_VALUE *)(*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(
BugCheckParameter3,
ValueByName,
v31);
if( !v25 )
return 0xFFFFFFFFi64;
v26 = CmpValueToData((_HHIVE *)BugCheckParameter3, ValueByName, v25, &realsize, &v35);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v31);
if( !v26 )
return 0xFFFFFFFFi64;
*a4 = v26->u.KeyNode.Signature;
(*((void(__fastcall **)(PVOID, _HV_GET_CELL_CONTEXT *))BugCheckParameter3 + 2))(BugCheckParameter3, &v35);
}
v12 = (*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(BugCheckParameter3, Cell, v29);
if( v12 )
{
v13 = CmpFindValueByName((__int64)BugCheckParameter3, v12, a3);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v29);
if( v13 != -1 )
{
v14 = (_CM_KEY_VALUE *)(*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(
BugCheckParameter3,
v13,
v31);
if( v14 )
{
if( v14->Type != 4 )
{
p_CellContext = (_HV_GET_CELL_CONTEXT *)v31;
goto LABEL_30;
}
v15 = CmpValueToData((_HHIVE *)BugCheckParameter3, v13, v14, &realsize, &CellContext);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v31);
if( v15 )
{
sprintf_s(Dst, 0x80ui64, (INT8 *)"ControlSet%03d", v15->u.KeyList[0]);
v16 = -1i64;
do
++v16;
while( Dst[v16] );
SourceString.MaximumLength = v16;
SourceString.Length = v16;
*(_DWORD *)&DestinationString.Length = 0x1000000;
SourceString.Buffer = Dst;
DestinationString.Buffer = (wchar_t *)&v39;
v17 = RtlAnsiStringToUnicodeString(&DestinationString, &SourceString, 0);
v18 = BugCheckParameter3;
if( v17 < 0
|| (v19 = (_CM_KEY_NODE *)(*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(
BugCheckParameter3,
v6,
v29),
v18 = BugCheckParameter3,
!v19)
|| (v33 = 0,
CmpFindSubKeyByNameWithStatus((_HHIVE *)BugCheckParameter3, v19, &DestinationString, &v33),
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v29),
v18 = BugCheckParameter3,
v33 == -1) )
{
p_CellContext = &CellContext;
goto LABEL_32;
}
v20 = (*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(
BugCheckParameter3,
Cell,
v29);
if( v20 )
{
RtlInitUnicodeString(&DestinationString, L"Current");
v21 = CmpFindValueByName((__int64)BugCheckParameter3, v20, (__int64)&DestinationString);
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v29);
if( v21 == -1 )
{
LABEL_23:
(*((void(__fastcall **)(PVOID, _HV_GET_CELL_CONTEXT *))BugCheckParameter3 + 2))(
BugCheckParameter3,
&CellContext);
return v33;
}
v22 = (_CM_KEY_VALUE *)(*((__int64(__fastcall **)(PVOID, _QWORD, int *))BugCheckParameter3 + 1))(
BugCheckParameter3,
v21,
v31);
if( v22 )
{
if( v22->Type != 4 )
{
LABEL_22:
(*((void(__fastcall **)(PVOID, int *))BugCheckParameter3 + 2))(BugCheckParameter3, v31);
goto LABEL_23;
}
v23 = CmpValueToData((_HHIVE *)BugCheckParameter3, v21, v22, &realsize, &v36);
if( v23 )
{
v23->u.KeyList[0] = v15->u.KeyList[0];
(*((void(__fastcall **)(PVOID, _HV_GET_CELL_CONTEXT *))BugCheckParameter3 + 2))(
BugCheckParameter3,
&v36);
goto LABEL_22;
}
}
}
p_CellContext = &CellContext;
LABEL_30:
v18 = BugCheckParameter3;
LABEL_32:
(*((void(__fastcall **)(PVOID, _HV_GET_CELL_CONTEXT *))BugCheckParameter3 + 2))(v18, p_CellContext);
}
}
}
}
return 0xFFFFFFFFi64;
}Referenced by:
CmpAcquireSystemDriverHiveContext
CmpGetSystemControlValues