RtlGetSystem
int __fastcall RtlGetSystem(unsigned __int32 a1, struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2, int *a3)
{
unsigned __int32 v3;
struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v4;
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v5;
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v6;
Windows::Rtl::SystemImplementation::DirectUserProvider *v7;
const char *v8;
int v9;
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v10;
int v11;
int v12;
void (__thiscall *v13)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *);
struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v14;
int (__thiscall *v15)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *);
int v16;
void (__thiscall *v17)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *);
int v18;
int v19;
Windows::Rtl::SystemImplementation::DirectRegistryProvider *v20;
void *v21;
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v22;
struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v23;
int v24;
char v26;
const char *v27;
char v28;
Windows::Rtl::SystemImplementation::DirectUserProvider *v29;
Windows::Rtl::SystemImplementation::DirectRegistryProvider *v30;
unsigned __int32 v31;
volatile signed __int32 *v32;
const char *v33;
const char *v34;
Windows::Rtl::SystemImplementation::DirectUserProvider *v35;
const char *v36;
char v37;
int v38;
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v39;
struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v40;
Windows::Rtl::SystemImplementation::DirectUserProvider *v41;
struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v42;
char v43;
int v44;
int v45;
char v46;
v3 = a1;
v38 = -1073741595;
v4 = (struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *)a3;
v5 = a2;
v31 = a1;
v32 = (volatile signed __int32 *)a3;
Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, a2);
v44 = 1;
v45 = 0;
v46 = 0;
if ( Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, v6) & 0xE )
Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::Arm(
(int)&v43,
0,
(int)&v38,
(int)Windows::WCP::Rtl::RtlTraceFormat_PCNTSTATUS,
0,
(int)"Windows::Rtl::RtlGetSystem",
(struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *)&Facility_SIL,
0,
0,
0,
0,
v26);
if ( !a3 )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8536;
v8 = "Not-null check failed: System";
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_50:
Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
(int)&v43,
(int)v8);
v33 = "base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
v34 = "Windows::Rtl::RtlGetSystem";
v35 = v7;
v36 = v8;
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
&v38,
(int)&v33);
return v38;
}
if ( v3 & 0xFFFFFFF0 )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8537;
v8 = "Valid flags check failed: Flags";
LABEL_7:
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
goto LABEL_50;
}
if ( v3 & 0xF && ((v3 & 0xF) - 1) & v3 & 0xF )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8538;
v8 = "No more than one flag set check failed: __e";
goto LABEL_7;
}
if ( !Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest || v5 )
{
v39 = 0;
v10 = 0;
v40 = 0;
v41 = 0;
v27 = 0;
v28 = 0;
v33 = 0;
v34 = 0;
v35 = 0;
v36 = 0;
v37 = 0;
if ( v5 )
{
v11 = *(_DWORD *)v5;
if ( !*(_DWORD *)v5 )
goto LABEL_76;
v42 = 0;
v12 = Windows::Rtl::SystemImplementation::SimpleCreateInterface<Windows::Rtl::SystemImplementation::IRtlSystemIsolationLayerInternal>(
v11,
&v42);
if ( v12 < 0 )
{
v4 = v42;
goto LABEL_19;
}
v14 = v42;
v15 = *(int (__thiscall **)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))(*(_DWORD *)v42 + 8);
__guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)v42 + 8));
v16 = v15(v14);
v12 = Windows::Rtl::SystemImplementation::CSystemIsolationLayer::GetProviders(v16, &v39, &v40, &v41);
v4 = v42;
if ( v12 < 0 )
{
LABEL_19:
v38 = v12;
if ( v4 )
{
v42 = 0;
v13 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
__guard_check_icall_fptr(**(_DWORD **)v4);
v13(v4);
}
goto LABEL_69;
}
if ( v42 )
{
v42 = 0;
v17 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
__guard_check_icall_fptr(**(_DWORD **)v4);
v17(v4);
}
v10 = v40;
if ( !v40 )
{
LABEL_76:
if ( *((_DWORD *)v5 + 2) <= 0u )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8582;
v8 = "ConstructorData->FilesystemLayers.Length > 0";
LABEL_33:
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_49:
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
goto LABEL_50;
}
}
if ( !v39 && *((_DWORD *)v5 + 4) <= 0u )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8585;
v8 = "ConstructorData->RegistryLayers.Length > 0";
goto LABEL_33;
}
if ( !v41 && *((_DWORD *)v5 + 6) <= 0u )
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8588;
v8 = "ConstructorData->UserLayers.Length > 0";
goto LABEL_33;
}
v18 = Windows::Rtl::SystemImplementation::CreateFilesystemProviderStack(v11, v10, (int)v5 + 4, (int *)&v40, &v28);
if ( v18 < 0 )
goto LABEL_68;
v18 = Windows::Rtl::SystemImplementation::CreateRegistryProviderStack(v19, v39, (int)v5 + 12, &v39, &v28);
if ( v18 < 0 )
goto LABEL_68;
v18 = Windows::Rtl::SystemImplementation::CreateUserProviderStack(v31, v41, v40, v39, (int)v5 + 20, (int *)&v41);
if ( v18 < 0 )
goto LABEL_68;
goto LABEL_66;
}
v42 = 0;
v30 = 0;
v29 = 0;
if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider *>::Allocate(&v42) )
{
if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::Allocate(&v30) )
{
if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectUserProvider *>::Allocate(&v29) )
{
v20 = v30;
v21 = Windows::Rtl::SystemImplementation::DirectRegistryProvider::Initialize(v30);
if ( (signed int)v21 >= 0 )
{
v4 = v42;
v24 = Windows::Rtl::SystemImplementation::DirectUserProvider::Initialize(v29, v22, v31, v42, v20, 0);
if ( v24 >= 0 )
{
v40 = v4;
v39 = v20;
v41 = v29;
LABEL_66:
v18 = Windows::Rtl::SystemImplementation::RtlGetTransactionCoordinator(
&v27,
(volatile signed __int32 *)v4);
if ( v18 >= 0 )
{
v33 = (const char *)v40;
v34 = (const char *)v39;
v35 = v41;
v37 = v28;
v36 = v27;
v18 = Windows::Rtl::CRtlOneShotTypeDescriptionInit<Windows::Rtl::SystemImplementation::CSystemIsolationLayer>::CreateInstance<Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff,Windows::Rtl::SystemImplementation::CreateSILSource,Windows::Rtl::IRtlSystemIsolationLayer>(
(const struct Windows::Rtl::SystemImplementation::CreateSILSource *)&v33,
v32);
if ( v18 >= 0 )
{
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
goto LABEL_73;
}
}
LABEL_68:
v38 = v18;
goto LABEL_69;
}
v38 = v24;
if ( v29 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
if ( v20 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
if ( !v4 )
goto LABEL_69;
v23 = v4;
}
else
{
v38 = (int)v21;
if ( v29 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
if ( v20 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
v23 = v42;
if ( !v42 )
goto LABEL_69;
}
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v23);
LABEL_69:
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
goto LABEL_70;
}
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8637;
v38 = -1073741801;
v8 = "User.Allocate()";
if ( v29 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
}
else
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8636;
v38 = -1073741801;
v8 = "Reg.Allocate()";
}
if ( v30 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v30);
}
else
{
v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *)8635;
v38 = -1073741801;
v8 = "Fs.Allocate()";
}
if ( v42 )
Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v42);
goto LABEL_49;
}
v9 = Windows::Rtl::IRtlObject::CreateRequiredInterface<Windows::Rtl::IRtlSystemIsolationLayer>(
(void *)Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest,
a3);
if ( v9 < 0 )
{
v38 = v9;
LABEL_70:
Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
(int)&v43,
(int)v4);
return v38;
}
LABEL_73:
v46 = 1;
v38 = 0;
Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,7>(
(int)&v43,
(int)v4);
return 0;
}