FindClassMoniker逆向结果

最新推荐文章于 2022-04-19 17:09:26 发布

王cb

最新推荐文章于 2022-04-19 17:09:26 发布

阅读量309

点赞数

始于C#，精于C&C++，醉心于Windows内核与Com组件安全研究

本文链接：https://blog.csdn.net/oShuangYue12/article/details/79366473

版权

HRESULT __stdcall FindClassMoniker(IBindCtx *pbc, const wchar_t *pszDisplayName, unsigned int *pcchEaten, IMoniker **ppmk)
{
  HRESULT v4; // esi
  struct _TEB *_currentTeb; // eax
  tagSOleTlsData *v6; // ecx
  HRESULT result; // eax
  int *v8; // ecx
  int v9; // edx
  bool v10; // zf
  tagSOleTlsData *v11; // ecx
  tagSOleTlsData *v12; // eax
  tagSOleTlsData *v13; // eax
  unsigned int cEaten; // [esp+Ch] [ebp-30h]
  IBindCtx *v15; // [esp+10h] [ebp-2Ch]
  const wchar_t *_displayName; // [esp+14h] [ebp-28h]
  IMoniker **v17; // [esp+18h] [ebp-24h]
  CActivationFilterContext activationContext; // [esp+1Ch] [ebp-20h]
  COleTls v19; // [esp+20h] [ebp-1Ch]
  IParseDisplayName *pPDN; // [esp+24h] [ebp-18h]
  _GUID classID; // [esp+28h] [ebp-14h]

  v15 = pbc;
  *ppmk = 0;
  v17 = ppmk;
  _currentTeb = NtCurrentTeb();
  *pcchEaten = 0;
  v6 = (tagSOleTlsData *)_currentTeb->ReservedForOle;
  _displayName = pszDisplayName;
  v19._pData = v6;
  if ( v6 )
  {
    result = 0;
  }
  else
  {
    result = COleTls::TLSAllocData(&v19);
    if ( result < 0 )
    {
LABEL_8:
      v11 = (tagSOleTlsData *)NtCurrentTeb()->ReservedForOle;
      if ( v11 )
        v11->dwActivationType = activationContext.m_dwPreviousActivationType;
      return result;
    }
    v6 = v19._pData;
  }
  v8 = (int *)&v6->dwActivationType;
  v9 = *v8;
  *v8 |= 1u;
  v10 = (v19._pData->dwFlags & 0x2000000) == 0;
  activationContext.m_dwPreviousActivationType = v9;
  if ( !v10 )
    result = -2147467231;
  if ( result < 0 )
    goto LABEL_8;
  if ( FindClassID(pszDisplayName, &cEaten, &classID) < 0
    || (pPDN = 0, CoGetClassObject(&classID, 0x417u, 0, &IID_IParseDisplayName, (LPVOID *)&pPDN) < 0)
    && CoCreateInstance(&classID, 0, 0x417u, &IID_IParseDisplayName, (LPVOID *)&pPDN) < 0 )
  {
    v13 = (tagSOleTlsData *)NtCurrentTeb()->ReservedForOle;
    if ( v13 )
      v13->dwActivationType = activationContext.m_dwPreviousActivationType;
    result = -2147221021;
  }
  else
  {
    v4 = pPDN->vtable->GetDisplayName((CFileMoniker *)pPDN, v15, _displayName, pcchEaten, v17);
    pPDN->vtable->Release((IUnknown *)pPDN);
    v12 = (tagSOleTlsData *)NtCurrentTeb()->ReservedForOle;
    if ( v12 )
      v12->dwActivationType = activationContext.m_dwPreviousActivationType;
    result = v4;
  }
  return result;
}