RtlGetSystem

179 篇文章 0 订阅
86 篇文章 0 订阅

RtlGetSystem

//----- (100F1410) --------------------------------------------------------
int __fastcall RtlGetSystem(unsigned __int32 a1, struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2, int *a3)
{
  unsigned __int32 v3; // esi@1
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v4; // edi@1
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v5; // ebx@1
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v6; // edx@1
  Windows::Rtl::SystemImplementation::DirectUserProvider *v7; // esi@4
  const char *v8; // edi@4
  int v9; // eax@13
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v10; // edx@15
  int v11; // ecx@16
  int v12; // eax@17
  void (__thiscall *v13)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // esi@20
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v14; // esi@21
  int (__thiscall *v15)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // edi@21
  int v16; // eax@21
  void (__thiscall *v17)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // esi@23
  int v18; // eax@34
  int v19; // ecx@34
  Windows::Rtl::SystemImplementation::DirectRegistryProvider *v20; // esi@51
  void *v21; // eax@51
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v22; // edx@51
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v23; // ecx@56
  int v24; // eax@58
  char v26; // [sp+0h] [bp-120h]@0
  const char *v27; // [sp+10h] [bp-110h]@15
  char v28; // [sp+17h] [bp-109h]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v29; // [sp+18h] [bp-108h]@38
  Windows::Rtl::SystemImplementation::DirectRegistryProvider *v30; // [sp+1Ch] [bp-104h]@38
  unsigned __int32 v31; // [sp+20h] [bp-100h]@1
  volatile signed __int32 *v32; // [sp+24h] [bp-FCh]@1
  const char *v33; // [sp+28h] [bp-F8h]@15
  const char *v34; // [sp+2Ch] [bp-F4h]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v35; // [sp+30h] [bp-F0h]@15
  const char *v36; // [sp+34h] [bp-ECh]@15
  char v37; // [sp+38h] [bp-E8h]@15
  int v38; // [sp+3Ch] [bp-E4h]@1
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v39; // [sp+40h] [bp-E0h]@15
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v40; // [sp+44h] [bp-DCh]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v41; // [sp+48h] [bp-D8h]@15
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v42; // [sp+4Ch] [bp-D4h]@17
  char v43; // [sp+50h] [bp-D0h]@2
  int v44; // [sp+54h] [bp-CCh]@1
  int v45; // [sp+68h] [bp-B8h]@1
  char v46; // [sp+74h] [bp-ACh]@1

  v3 = a1;
  v38 = -1073741595;
  v4 = (struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *)a3;
  v5 = a2;
  v31 = a1;
  v32 = (volatile signed __int32 *)a3;
  Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, a2);
  v44 = 1;
  v45 = 0;
  v46 = 0;
  if ( Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, v6) & 0xE )
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::Arm(
      (int)&v43,
      0,
      (int)&v38,
      (int)Windows::WCP::Rtl::RtlTraceFormat_PCNTSTATUS,
      0,
      (int)"Windows::Rtl::RtlGetSystem",
      (struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *)&Facility_SIL,
      0,
      0,
      0,
      0,
      v26);
  if ( !a3 )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8536;
    v8 = "Not-null check failed: System";
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_50:
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
      (int)&v43,
      (int)v8);
    v33 = "base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
    v34 = "Windows::Rtl::RtlGetSystem";
    v35 = v7;
    v36 = v8;
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
      &v38,
      (int)&v33);
    return v38;
  }
  if ( v3 & 0xFFFFFFF0 )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8537;
    v8 = "Valid flags check failed: Flags";
LABEL_7:
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
    goto LABEL_50;
  }
  if ( v3 & 0xF && ((v3 & 0xF) - 1) & v3 & 0xF )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8538;
    v8 = "No more than one flag set check failed: __e";
    goto LABEL_7;
  }
  if ( !Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest || v5 )
  {
    v39 = 0;
    v10 = 0;
    v40 = 0;
    v41 = 0;
    v27 = 0;
    v28 = 0;
    v33 = 0;
    v34 = 0;
    v35 = 0;
    v36 = 0;
    v37 = 0;
    if ( v5 )
    {
      v11 = *(_DWORD *)v5;
      if ( !*(_DWORD *)v5 )
        goto LABEL_76;
      v42 = 0;
      v12 = Windows::Rtl::SystemImplementation::SimpleCreateInterface<Windows::Rtl::SystemImplementation::IRtlSystemIsolationLayerInternal>(
              v11,
              &v42);
      if ( v12 < 0 )
      {
        v4 = v42;
        goto LABEL_19;
      }
      v14 = v42;
      v15 = *(int (__thiscall **)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))(*(_DWORD *)v42 + 8);
      __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)v42 + 8));
      v16 = v15(v14);
      v12 = Windows::Rtl::SystemImplementation::CSystemIsolationLayer::GetProviders(v16, &v39, &v40, &v41);
      v4 = v42;
      if ( v12 < 0 )
      {
LABEL_19:
        v38 = v12;
        if ( v4 )
        {
          v42 = 0;
          v13 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
          __guard_check_icall_fptr(**(_DWORD **)v4);
          v13(v4);
        }
        goto LABEL_69;
      }
      if ( v42 )
      {
        v42 = 0;
        v17 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
        __guard_check_icall_fptr(**(_DWORD **)v4);
        v17(v4);
      }
      v10 = v40;
      if ( !v40 )
      {
LABEL_76:
        if ( *((_DWORD *)v5 + 2) <= 0u )
        {
          v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8582;
          v8 = "ConstructorData->FilesystemLayers.Length > 0";
LABEL_33:
          Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_49:
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
          goto LABEL_50;
        }
      }
      if ( !v39 && *((_DWORD *)v5 + 4) <= 0u )
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8585;
        v8 = "ConstructorData->RegistryLayers.Length > 0";
        goto LABEL_33;
      }
      if ( !v41 && *((_DWORD *)v5 + 6) <= 0u )
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8588;
        v8 = "ConstructorData->UserLayers.Length > 0";
        goto LABEL_33;
      }
      v18 = Windows::Rtl::SystemImplementation::CreateFilesystemProviderStack(v11, v10, (int)v5 + 4, (int *)&v40, &v28);
      if ( v18 < 0 )
        goto LABEL_68;
      v18 = Windows::Rtl::SystemImplementation::CreateRegistryProviderStack(v19, v39, (int)v5 + 12, &v39, &v28);
      if ( v18 < 0 )
        goto LABEL_68;
      v18 = Windows::Rtl::SystemImplementation::CreateUserProviderStack(v31, v41, v40, v39, (int)v5 + 20, (int *)&v41);
      if ( v18 < 0 )
        goto LABEL_68;
      goto LABEL_66;
    }
    v42 = 0;
    v30 = 0;
    v29 = 0;
    if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider *>::Allocate(&v42) )
    {
      if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::Allocate(&v30) )
      {
        if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectUserProvider *>::Allocate(&v29) )
        {
          v20 = v30;
          v21 = Windows::Rtl::SystemImplementation::DirectRegistryProvider::Initialize(v30);
          if ( (signed int)v21 >= 0 )
          {
            v4 = v42;
            v24 = Windows::Rtl::SystemImplementation::DirectUserProvider::Initialize(v29, v22, v31, v42, v20, 0);
            if ( v24 >= 0 )
            {
              v40 = v4;
              v39 = v20;
              v41 = v29;
LABEL_66:
              v18 = Windows::Rtl::SystemImplementation::RtlGetTransactionCoordinator(
                      &v27,
                      (volatile signed __int32 *)v4);
              if ( v18 >= 0 )
              {
                v33 = (const char *)v40;
                v34 = (const char *)v39;
                v35 = v41;
                v37 = v28;
                v36 = v27;
                v18 = Windows::Rtl::CRtlOneShotTypeDescriptionInit<Windows::Rtl::SystemImplementation::CSystemIsolationLayer>::CreateInstance<Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff,Windows::Rtl::SystemImplementation::CreateSILSource,Windows::Rtl::IRtlSystemIsolationLayer>(
                        (const struct Windows::Rtl::SystemImplementation::CreateSILSource *)&v33,
                        v32);
                if ( v18 >= 0 )
                {
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
                  goto LABEL_73;
                }
              }
LABEL_68:
              v38 = v18;
              goto LABEL_69;
            }
            v38 = v24;
            if ( v29 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
            if ( v20 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
            if ( !v4 )
              goto LABEL_69;
            v23 = v4;
          }
          else
          {
            v38 = (int)v21;
            if ( v29 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
            if ( v20 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
            v23 = v42;
            if ( !v42 )
              goto LABEL_69;
          }
          Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v23);
LABEL_69:
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
          goto LABEL_70;
        }
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8637;
        v38 = -1073741801;
        v8 = "User.Allocate()";
        if ( v29 )
          Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
      }
      else
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8636;
        v38 = -1073741801;
        v8 = "Reg.Allocate()";
      }
      if ( v30 )
        Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v30);
    }
    else
    {
      v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8635;
      v38 = -1073741801;
      v8 = "Fs.Allocate()";
    }
    if ( v42 )
      Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v42);
    goto LABEL_49;
  }
  v9 = Windows::Rtl::IRtlObject::CreateRequiredInterface<Windows::Rtl::IRtlSystemIsolationLayer>(
         (void *)Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest,
         a3);
  if ( v9 < 0 )
  {
    v38 = v9;
LABEL_70:
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
      (int)&v43,
      (int)v4);
    return v38;
  }
LABEL_73:
  v46 = 1;
  v38 = 0;
  Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
    (int)&v43,
    (int)v4);
  return 0;
}
// 1027D610: using guessed type struct Windows::Rtl::IRtlSystemIsolationLayer *Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest;
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值