创建重要文件

最新推荐文章于 2021-11-24 16:20:00 发布

心想才事成

最新推荐文章于 2021-11-24 16:20:00 发布

阅读量396

点赞数

分类专栏：编程语言操作系统相关 WCP 系统维护

本文链接：https://blog.csdn.net/hadstj/article/details/53366892

版权

系统维护同时被 3 个专栏收录

248 篇文章 0 订阅

订阅专栏

操作系统相关

179 篇文章 0 订阅

订阅专栏

WCP

86 篇文章 0 订阅

订阅专栏

创建重要文件

//----- (10121F8A)--------------------------------------------------------
int __fastcall CreateImportantFiles(int a1, int*a2, int a3, int a4, int *a5, int *a6, int *a7)
{

v85 =-2147023537;
v7 =a2;
if (a1 & 0xFFFFFFFE) // dwFlags 0 1
{
}
v50 =20;
v51 =0;
v53 =0;
v54 =0;
v52 =64;
if (a1 & 1)
{
    v68 =0;
    v10 =SimpleCreateDirectory(a2, (int)g_LUNICODE_STRING_EFI,(int *)&v68);
    v70 =0;
    v12 =SimpleCreateDirectory(v68, (int)g_LUNICODE_STRING_Microsoft,(int *)&v70);
    v69 =0;
    v13 =SimpleCreateDirectory(v70,(int)g_LUNICODE_STRING_boot, &v69);
    AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v69);
    AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v70);
    AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v68);
}
v84 =0;
v14 =SimpleCreateDirectory(v7, (int)g_LUNICODE_STRING_Windows,(int *)&v84);
v83 =0;
v15 =SimpleCreateDirectory(v7,(int)g_LUNICODE_STRING_Program_space_Files, (int *)&v83);
v82 =0;
v16 =SimpleCreateDirectory(v83,(int)g_LUNICODE_STRING_Common_space_Files, &v82);
v17 =*(_DWORD*)(a4+ 48);
if (v17 == 6|| v17 ==9 ||v17 == 5|| v17 ==12 )
{
    v70 =0;
    v18 =SimpleCreateDirectory(
            v7,
            (int)g_LUNICODE_STRING_Program_space_Files_space__lparen_x86_rparen_,
            (int*)&v70);
    v69 =0;
    v20 =SimpleCreateDirectory(v70,(int)g_LUNICODE_STRING_Common_space_Files, &v69);
    AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v69);
    AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v70);
}
v81 =0;
v21 =SimpleCreateDirectory(v7,(int)g_LUNICODE_STRING_Users, (int *)&v81);
v80 =0;
v22 =SimpleCreateDirectory(v81,(int)g_LUNICODE_STRING_Default, &v80);
v79 =0;
v23 =SimpleCreateDirectory(v84,(int)g_LUNICODE_STRING_servicing, (int *)&v79);
if (v23 < 0
    ||(v23 =SimpleCreateDirectory(v79,(int)g_LUNICODE_STRING_Packages, 0), v23 < 0)
    ||(v23 =SimpleCreateDirectory(v79,(int)g_LUNICODE_STRING_Sessions, 0), v23 < 0) )
{
}
v78 =0;
v24 =SimpleCreateDirectory(v84,(int)g_LUNICODE_STRING_System32, (int *)&v78);
v77 =0;
v25 =SimpleCreateDirectory(v78,(int)g_LUNICODE_STRING_CatRoot, (int *)&v77);
if (v25 < 0
    ||(v25 =SimpleCreateDirectory(
                v77,
                (int)g_LUNICODE_STRING__lbrace_F750E6C3_dash_38EE_dash_11D1_dash_85E5_dash_00C04FC295EE_rbrace_,
                0),
        v25 <0) )
{
}
v76 =0;
v26 =SimpleCreateDirectory(v78,(int)g_LUNICODE_STRING_config, &v76);
v75 =0;
v27 =SimpleCreateDirectory(v78, (int)g_LUNICODE_STRING_SMI,(int *)&v75);
v74 =0;
v28 =SimpleCreateDirectory(v75,(int)g_LUNICODE_STRING_Schema, &v74);
v73 =0;
v29 =SimpleCreateDirectory(v75,(int)g_LUNICODE_STRING_Store, (int *)&v73);
v72 =0;
v30 =SimpleCreateDirectory(v73,(int)g_LUNICODE_STRING_Machine, &v72);
if (v30 < 0
    ||(v30 =SimpleCreateDirectoryWithSecurity(
                1024,
                (int)v78,
                (int)g_LUNICODE_STRING_DriverStore,
                0),
        v30 <0)
    ||(v30 =CreateWinSxSSkeletonWithSecurity(v84), v30 < 0) )
{
}
v31 =v74;
v51 =g_LUNICODE_STRING_WcmTypes_dot_xsd;
v71 =0;
v32 =*(_DWORD*)v74;
v33 =(*(int (__thiscall**)(int,_DWORD, signed int, int *,signed int, signed int, signed int, signedint, int *, _DWORD))(v32 + 28))(
          v31,
          0,
          1179926,
          &v50,
          128,
          7,
          5,
          16480,
          &v71,
          0);
if (v33 < 0
    ||(v34 =v71,
        v35 =*(int(__thiscall **)(int, _DWORD, int *))(*(_DWORD *)v71 + 28),
        v33 =v35(v34, 0,dword_10012020),
        v33 <0) )
{
}
v36 =*a5;
*a5= v76;
v76 =v36;
v37 =*a6;
*a6= v80;
v80 =v37;
v38 =*a7;
*a7= v72;
v65 =0;
v66 =0;
v67 =0;
v39 =*v7;
v72 =v38;
v40 =*(int(__thiscall **)(int *,signed int, int *))(v39 + 20);
v41 =v40(v7, 2, &v65);
v42 =v84;
v62 =0;
v63 =0;
v64 =0;
v43 =*(int(__thiscall **)(_DWORD *,signed int, int *))(*v84 + 20);
v44 =v43(v42, 2, &v62);
v59 =0;
v60 =0;
v61 =0;
v45 =RtlConvertNtFilePathToWin32FilePath((int)&v65,&v59);
v56 =0;
v57 =0;
v58 =0;
v46 =RtlConvertNtFilePathToWin32FilePath((int)&v62,&v56);
v9 =COM::CopyOut((int)&v59,(_DWORD *)(a4 + 8));
v47 =(int *)&v56;
v9 =COM::CopyOut((int)&v56,(_DWORD *)(a4 + 12));
if (v9 < 0|| (v9= COM::CopyOut(a3, (_DWORD *)(a4 + 16)), v9 <0) )
{ }
AutoPODBase<_LUNICODE_STRING,Auto<_LUNICODE_STRING>>::Close((int)&v56);
AutoPODBase<_LUNICODE_STRING,Auto<_LUNICODE_STRING>>::Close((int)&v59);
AutoPODBase<_LUNICODE_STRING,Auto<_LUNICODE_STRING>>::Close((int)&v62);
AutoPODBase<_LUNICODE_STRING,Auto<_LUNICODE_STRING>>::Close((int)&v65);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v71);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v72);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v73);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v74);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v75);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v76);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v77);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v78);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v79);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v80);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v81);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v82);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v83);
AutoPointerBase<IRtlCdfStringTableEnumerator *,Auto<IRtlCdfStringTableEnumerator*>>::Close(&v84);
return 0;
}