CmpSetVersionData

VOID __stdcall CmpSetVersionData(){
  UINT8 v0; 
  UINT32 v1; 
  CHAR *v2; 
  INT16 *i; 
  const wchar_t *v4; 
  NTSTATUS Key; 
  VOID *v6; 
  NTSTATUS v7; 
  NTSTATUS v8; 
  _OBJECT_TYPE *v9; 
  _OBJECT_TYPE *v10; 
  PKINTERRUPT_ROUTINE **v11; 
  UINT32 v12; 
  PKINTERRUPT_ROUTINE *v13; 
  _EJOB *v14; 
  _ESERVERSILO_GLOBALS *ServerSiloGlobals; 
  UINT32 v16; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  UINT64 CreateOptionsc; 
  UINT64 CreateOptionse; 
  UINT64 CreateOptionsf; 
  UINT64 CreateOptionsd; 
  VOID *KeyHandle; 
  int Data; 
  _UNICODE_STRING Data_8; 
  VOID *ObjectAttributes[7]; 
  _UNICODE_STRING DestinationString; 
  _STRING SourceString; 
  INT8 Dst[128]; 
  char v31[256]; 

  KeyHandle = 0i64;
  memset(ObjectAttributes, 0, sizeof(ObjectAttributes));
  SourceString = 0i64;
  Data = 0;
  DestinationString = 0i64;
  Data_8 = 0i64;
  memset((char *)&CmpDummyThreadEvent + 2080, 0i64, 0x238u);
  v2 = CmpHiveRootSecurityDescriptor(v0);
  if( VersionDataKeys )
  {
    for( i = (INT16 *)&unk_140C04400; *((_QWORD *)i - 2); i += 12 )
    {
      if( *i == -31132 || PsWow64IsMachineSupported(*i) )
      {
        RtlInitUnicodeString(&DestinationString, *((PCWSTR *)i - 2));
        LODWORD(CreateOptions) = 0;
        LODWORD(ObjectAttributes[1]) = 48;
        ObjectAttributes[2] = 0i64;
        LODWORD(ObjectAttributes[4]) = 576;
        ObjectAttributes[3] = &DestinationString;
        ObjectAttributes[5] = v2;
        ObjectAttributes[6] = 0i64;
        if( ZwCreateKey(
               &KeyHandle,
               4ui64,
               (_OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
               0i64,
               (_UNICODE_STRING *)&nullclass,
               CreateOptions,
               0i64) < 0 )
          goto LABEL_27;
        v4 = (const wchar_t *)*((_QWORD *)i - 1);
        if( v4 )
        {
          RtlInitUnicodeString(&DestinationString, v4);
          ObjectAttributes[2] = KeyHandle;
          LODWORD(CreateOptionsa) = 0;
          LODWORD(ObjectAttributes[1]) = 48;
          LODWORD(ObjectAttributes[4]) = 576;
          ObjectAttributes[3] = &DestinationString;
          ObjectAttributes[5] = v2;
          ObjectAttributes[6] = 0i64;
          Key = ZwCreateKey(
                  ObjectAttributes,
                  2ui64,
                  (_OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
                  0i64,
                  (_UNICODE_STRING *)&nullclass,
                  CreateOptionsa,
                  0i64);
          ZwClose((_HANDLE)KeyHandle);
          if( Key < 0 )
            goto LABEL_27;
          v6 = ObjectAttributes[0];
          KeyHandle = ObjectAttributes[0];
        }
        else
        {
          v6 = KeyHandle;
        }
        ObjectAttributes[2] = v6;
        LODWORD(CreateOptionsa) = 0;
        LODWORD(ObjectAttributes[1]) = 48;
        LODWORD(ObjectAttributes[4]) = 576;
        ObjectAttributes[3] = &CmpWindowsNtString;
        ObjectAttributes[5] = v2;
        ObjectAttributes[6] = 0i64;
        v7 = ZwCreateKey(
               ObjectAttributes,
               2ui64,
               (_OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
               0i64,
               (_UNICODE_STRING *)&nullclass,
               CreateOptionsa,
               0i64);
        ZwClose((_HANDLE)KeyHandle);
        if( v7 < 0 )
          goto LABEL_27;
        ObjectAttributes[2] = ObjectAttributes[0];
        LODWORD(CreateOptionsb) = 0;
        ObjectAttributes[3] = (VOID *)&CmpCurrentVersionString;
        LODWORD(ObjectAttributes[1]) = 48;
        LODWORD(ObjectAttributes[4]) = 576;
        ObjectAttributes[5] = v2;
        ObjectAttributes[6] = 0i64;
        v8 = ZwCreateKey(
               &KeyHandle,
               3ui64,
               (_OBJECT_ATTRIBUTES *)&ObjectAttributes[1],
               0i64,
               (_UNICODE_STRING *)&nullclass,
               CreateOptionsb,
               0i64);
        ZwClose((_HANDLE)ObjectAttributes[0]);
        if( v8 < 0 )
          goto LABEL_27;
        if( *i == -31132 && CmpQueryEditionVersion((char *)&CmpDummyThreadEvent + 2080, KeyHandle, v2) >= 0 )
        {
          NtBuildNumber = *(&CmpDummyThreadEvent + 520) | 0xF0000000;
          KUSER_SHARED_DATA.NtBuildNumber = *(&CmpDummyThreadEvent + 520);
          NtBuildQfe = *(&CmpDummyThreadEvent + 521);
        }
        LODWORD(CreateOptionsc) = CmVersionString.Length + 2;
        ZwSetValueKey(
          KeyHandle,
          (_UNICODE_STRING *)&CmpCurrentVersionString,
          0i64,
          1ui64,
          CmVersionString.Buffer,
          CreateOptionsc);
        Data = 10;
        LODWORD(CreateOptionse) = 4;
        ZwSetValueKey(KeyHandle, (_UNICODE_STRING *)&CmpCurrentMajorVersionString, 0i64, 4ui64, &Data, CreateOptionse);
        LODWORD(CreateOptionsf) = 4;
        Data = 0;
        ZwSetValueKey(KeyHandle, (_UNICODE_STRING *)&CmpCurrentMinorVersionString, 0i64, 4ui64, &Data, CreateOptionsf);
        Data = 0;
        if( *(&CmpDummyThreadEvent + 520) )
          CmpRestampVersion(KeyHandle, (__int64)&CmpDummyThreadEvent + 2080);
        sprintf_s(Dst, 0x80ui64, (INT8 *)"%s %s", "Multiprocessor", "Free");
        RtlInitAnsiString(&SourceString, Dst);
        *(_DWORD *)&Data_8.Length = 0x1000000;
        Data_8.Buffer = (wchar_t *)v31;
        if( RtlAnsiStringToUnicodeString(&Data_8, &SourceString, 0) >= 0 )
        {
          LODWORD(CreateOptionsd) = Data_8.Length + 2;
          ZwSetValueKey(KeyHandle, (_UNICODE_STRING *)&CmpCurrentTypeString, 0i64, 1ui64, Data_8.Buffer, CreateOptionsd);
          if( CmCSDVersionString.Length )
          {
            LODWORD(CreateOptionsd) = CmCSDVersionString.Length + 2;
            ZwSetValueKey(
              KeyHandle,
              (_UNICODE_STRING *)&CmpCsdVersionString,
              0i64,
              1ui64,
              CmCSDVersionString.Buffer,
              CreateOptionsd);
            if( CmCSDVersionString.Buffer )
              ExFreePoolWithTag(CmCSDVersionString.Buffer, v16);
            RtlInitUnicodeString(&CmCSDVersionString, 0i64);
          }
          else
          {
            ZwDeleteValueKey(KeyHandle, (_UNICODE_STRING *)&CmpCsdVersionString, v10);
          }
        }
        if( CmNtSpBuildNumber )
        {
          sprintf_s(Dst, 0x80ui64, (INT8 *)"%u", (unsigned int)CmNtSpBuildNumber);
          RtlInitAnsiString(&SourceString, Dst);
          *(_DWORD *)&Data_8.Length = 0x1000000;
          Data_8.Buffer = (wchar_t *)v31;
          if( RtlAnsiStringToUnicodeString(&Data_8, &SourceString, 0) < 0 )
          {
            LODWORD(CreateOptionsd) = Data_8.Length + 2;
            ZwSetValueKey(
              KeyHandle,
              (_UNICODE_STRING *)&CmpCsdBuildNumberString,
              0i64,
              1ui64,
              Data_8.Buffer,
              CreateOptionsd);
          }
        }
        else
        {
          ZwDeleteValueKey(KeyHandle, (_UNICODE_STRING *)&CmpCsdBuildNumberString, v9);
        }
        LODWORD(v14) = HalSystemVectorDispatchEntry(v12, v11, v13);
        ServerSiloGlobals = PsGetServerSiloGlobals(v14);
        LODWORD(CreateOptionsd) = ServerSiloGlobals->NtSystemRoot.Length + 2;
        ZwSetValueKey(
          KeyHandle,
          (_UNICODE_STRING *)&CmpSystemRootString,
          0i64,
          1ui64,
          ServerSiloGlobals->NtSystemRoot.Buffer,
          CreateOptionsd);
        ZwClose((_HANDLE)KeyHandle);
      }
    }
  }
  if( CmCSDVersionString.Buffer )
    ExFreePoolWithTag(CmCSDVersionString.Buffer, v1);
  RtlInitUnicodeString(&CmCSDVersionString, 0i64);
LABEL_27:
  ExFreePoolWithTag(v2, 0);
}

Referenced by: