EmInitSystem
NTSTATUS __stdcall EmInitSystem(UINT64 Phase, _LOADER_PARAMETER_BLOCK *LoaderBlock){
VOID **PoolWithTag;
VOID **v3;
int v4;
NTSTATUS v5;
unsigned int v6;
unsigned int v7;
NTSTATUS i;
_LOADER_PARAMETER_EXTENSION *Extension;
void *EmInfFileImage;
UINT64 EmInfFileSize;
ULONG v13;
VOID **v14;
VOID **v15;
VOID **v16;
_UNICODE_STRING *Class;
_UNICODE_STRING *Classa;
_UNICODE_STRING *Classb;
UINT64 CreateOptions;
UINT64 CreateOptionsa;
UINT64 *Disposition;
UINT64 CreateDisposition;
UINT64 v24;
UINT64 EaLength;
UINT64 ResultLength;
VOID *Handle;
VOID *DestinationString[3];
_STRING Destination;
_OBJECT_ATTRIBUTES ObjectAttributes;
_IO_STATUS_BLOCK IoStatusBlock;
__int128 FileInformation;
__int64 v33;
char v34;
LODWORD(ResultLength) = 0;
v33 = 0i64;
PoolWithTag = 0i64;
DestinationString[0] = (VOID *)-1i64;
v3 = 0i64;
Handle = (VOID *)-1i64;
FileInformation = 0i64;
Destination = 0i64;
IoStatusBlock = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
*(_OWORD *)&DestinationString[1] = 0i64;
if( !(_DWORD)Phase )
{
dword_140C47698 |= 0x80000000;
EmpRuleUpdateWorker.WorkerRoutine = (void(__fastcall *)(void *))EmpRuleUpdateWorkerThread;
EmpParseLock._bf_0 = 0i64;
EmpDatabaseLock._bf_0 = 0i64;
EmpEvaluationQueueLock._bf_0 = 0i64;
EmpPagingLock._bf_0 = 0i64;
EmpEntryListHead = 0i64;
EmpCallbackListHead = 0i64;
EmpRuleListHead = 0i64;
EmpTargetRuleListHead = 0i64;
EmpRuleUpdateQueue = 0i64;
EmpWorkerBusy = 0;
EmpRuleUpdateWorker.Parameter = 0i64;
EmpRuleUpdateWorker.List.Flink = 0i64;
Extension = LoaderBlock->Extension;
qword_140C50898 = 0i64;
dword_140C50890 = 0;
dword_140C50894 = 0;
EmInfFileImage = Extension->EmInfFileImage;
dword_140C50884 = 0;
dword_140C50888 = 0;
dword_140C5088C = 0;
if( EmInfFileImage )
{
EmInfFileSize = Extension->EmInfFileSize;
if( (_DWORD)EmInfFileSize )
{
v4 = EmpParseInfDatabase(EmInfFileImage, EmInfFileSize);
if( v4 < 0 )
goto LABEL_11;
}
}
EmpCacheBiosDate();
HalRegisterErrataCallbacks();
LODWORD(Class) = 6;
v4 = EmpProviderRegister(
0i64,
0i64,
0i64,
(INT64)&BuiltinCallbackReg,
(UINT64)Class,
(UINT64 *)&EmBuiltinProviderHandle);
if( v4 < 0 )
goto LABEL_11;
LABEL_10:
v4 = 0;
goto LABEL_11;
}
if( (_DWORD)Phase != 1 )
goto LABEL_10;
RtlInitUnicodeString(
(PUNICODE_STRING)&DestinationString[1],
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Errata\\Dynamic");
LODWORD(CreateOptions) = 0;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v4 = ZwCreateKey(DestinationString, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
if( v4 < 0 )
goto LABEL_11;
v5 = ZwQueryKey(DestinationString[0], KeyFullInformation, 0i64, 0i64, &ResultLength);
v4 = v5;
if( v5 == -1073741789 || v5 == -2147483643 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ResultLength, 1953058117i64);
if( !PoolWithTag )
goto LABEL_29;
v4 = ZwQueryKey(DestinationString[0], KeyFullInformation, PoolWithTag, (unsigned int)ResultLength, &ResultLength);
if( v4 < 0 )
goto LABEL_11;
v6 = *((_DWORD *)PoolWithTag + 10) + 16;
v3 = ExAllocatePoolWithTag(1ui64, v6, 1953058117i64);
if( !v3 )
{
LABEL_29:
v4 = -1073741670;
goto LABEL_11;
}
LODWORD(Classa) = v6;
v7 = 0;
for( i = ZwEnumerateValueKey(
DestinationString[0],
0i64,
KeyValuePartialInformation,
v3,
(UINT64)Classa,
&ResultLength);
;
i = ZwEnumerateValueKey(
DestinationString[0],
v7,
KeyValuePartialInformation,
v3,
(UINT64)Classb,
&ResultLength) )
{
v4 = i;
if( i == -2147483622 )
break;
if( i < 0 )
goto LABEL_11;
*(_DWORD *)&Destination.Length = 0x1000000;
Destination.Buffer = &v34;
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"\\SystemRoot\\inf\\");
RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString[1]);
*((_BYTE *)v3 + *((unsigned int *)v3 + 2) + 12) = 0;
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], (PCWSTR)v3 + 6);
RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString[1]);
LODWORD(EaLength) = 0;
LODWORD(v24) = 32;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&Destination;
ObjectAttributes.Length = 48;
LODWORD(CreateDisposition) = 1;
LODWORD(Disposition) = 1;
LODWORD(CreateOptionsa) = 128;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v4 = ZwCreateFile(
&Handle,
0x120089ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
CreateOptionsa,
(UINT64)Disposition,
CreateDisposition,
v24,
0i64,
EaLength);
if( v4 < 0 )
goto LABEL_11;
v4 = ZwQueryInformationFile(Handle, &IoStatusBlock, &FileInformation, 0x18ui64, FileStandardInformation);
if( v4 < 0 )
{
ZwClose((_HANDLE)Handle);
goto LABEL_11;
}
if( HIDWORD(FileInformation) )
{
ZwClose((_HANDLE)Handle);
goto LABEL_27;
}
v13 = DWORD2(FileInformation);
v14 = ExAllocatePoolWithTag(1ui64, DWORD2(FileInformation), 1953058117i64);
v15 = v14;
if( !v14 )
{
ZwClose((_HANDLE)Handle);
goto LABEL_29;
}
v4 = ZwReadFile((_HANDLE)Handle, 0, 0i64, 0i64, &IoStatusBlock, v14, v13, 0i64, 0i64);
ZwClose((_HANDLE)Handle);
v16 = v15;
if( v4 < 0 )
goto LABEL_39;
v4 = EmpParseInfDatabase(v15, v13);
if( v4 < 0 )
{
v16 = v15;
LABEL_39:
ExFreePoolWithTag(v16, 0x74694D45u);
goto LABEL_11;
}
++v7;
LODWORD(Classb) = v6;
}
goto LABEL_10;
}
if( !v5 )
LABEL_27:
v4 = -1073741823;
LABEL_11:
if( DestinationString[0] != (VOID *)-1i64 )
ZwClose((_HANDLE)DestinationString[0]);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x74694D45u);
if( v3 )
ExFreePoolWithTag(v3, 0x74694D45u);
return v4;
}Referenced by:
Phase1InitializationIoReady