天天看點

RtlGetSystemRtlGetSystem

RtlGetSystem

//----- (100F1410) --------------------------------------------------------
int __fastcall RtlGetSystem(unsigned __int32 a1, struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2, int *a3)
{
  unsigned __int32 v3; // [email protected]
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v4; // [email protected]
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v5; // [email protected]
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v6; // [email protected]
  Windows::Rtl::SystemImplementation::DirectUserProvider *v7; // [email protected]
  const char *v8; // [email protected]
  int v9; // [email protected]
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v10; // [email protected]
  int v11; // [email protected]
  int v12; // [email protected]
  void (__thiscall *v13)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // [email protected]
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v14; // [email protected]
  int (__thiscall *v15)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // [email protected]
  int v16; // [email protected]
  void (__thiscall *v17)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *); // [email protected]
  int v18; // [email protected]
  int v19; // [email protected]
  Windows::Rtl::SystemImplementation::DirectRegistryProvider *v20; // [email protected]
  void *v21; // [email protected]
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v22; // [email protected]
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v23; // [email protected]
  int v24; // [email protected]
  char v26; // [sp+0h] [bp-120h]@0
  const char *v27; // [sp+10h] [bp-110h]@15
  char v28; // [sp+17h] [bp-109h]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v29; // [sp+18h] [bp-108h]@38
  Windows::Rtl::SystemImplementation::DirectRegistryProvider *v30; // [sp+1Ch] [bp-104h]@38
  unsigned __int32 v31; // [sp+20h] [bp-100h]@1
  volatile signed __int32 *v32; // [sp+24h] [bp-FCh]@1
  const char *v33; // [sp+28h] [bp-F8h]@15
  const char *v34; // [sp+2Ch] [bp-F4h]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v35; // [sp+30h] [bp-F0h]@15
  const char *v36; // [sp+34h] [bp-ECh]@15
  char v37; // [sp+38h] [bp-E8h]@15
  int v38; // [sp+3Ch] [bp-E4h]@1
  struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *v39; // [sp+40h] [bp-E0h]@15
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v40; // [sp+44h] [bp-DCh]@15
  Windows::Rtl::SystemImplementation::DirectUserProvider *v41; // [sp+48h] [bp-D8h]@15
  struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *v42; // [sp+4Ch] [bp-D4h]@17
  char v43; // [sp+50h] [bp-D0h]@2
  int v44; // [sp+54h] [bp-CCh]@1
  int v45; // [sp+68h] [bp-B8h]@1
  char v46; // [sp+74h] [bp-ACh]@1

  v3 = a1;
  v38 = -;
  v4 = (struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *)a3;
  v5 = a2;
  v31 = a1;
  v32 = (volatile signed __int32 *)a3;
  Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, a2);
  v44 = ;
  v45 = ;
  v46 = ;
  if ( Windows::WCP::Rtl::RtlGetFacilityTracingFlags((Windows::WCP::Rtl *)&Facility_SIL, v6) &  )
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>::Arm(
      (int)&v43,
      ,
      (int)&v38,
      (int)Windows::WCP::Rtl::RtlTraceFormat_PCNTSTATUS,
      ,
      (int)"Windows::Rtl::RtlGetSystem",
      (struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *)&Facility_SIL,
      ,
      ,
      ,
      ,
      v26);
  if ( !a3 )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
    v8 = "Not-null check failed: System";
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_50:
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>(
      (int)&v43,
      (int)v8);
    v33 = "base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
    v34 = "Windows::Rtl::RtlGetSystem";
    v35 = v7;
    v36 = v8;
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
      &v38,
      (int)&v33);
    return v38;
  }
  if ( v3 &  )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
    v8 = "Valid flags check failed: Flags";
LABEL_7:
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
    goto LABEL_50;
  }
  if ( v3 &  && ((v3 & ) - ) & v3 &  )
  {
    v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
    v8 = "No more than one flag set check failed: __e";
    goto LABEL_7;
  }
  if ( !Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest || v5 )
  {
    v39 = ;
    v10 = ;
    v40 = ;
    v41 = ;
    v27 = ;
    v28 = ;
    v33 = ;
    v34 = ;
    v35 = ;
    v36 = ;
    v37 = ;
    if ( v5 )
    {
      v11 = *(_DWORD *)v5;
      if ( !*(_DWORD *)v5 )
        goto LABEL_76;
      v42 = ;
      v12 = Windows::Rtl::SystemImplementation::SimpleCreateInterface<Windows::Rtl::SystemImplementation::IRtlSystemIsolationLayerInternal>(
              v11,
              &v42);
      if ( v12 <  )
      {
        v4 = v42;
        goto LABEL_19;
      }
      v14 = v42;
      v15 = *(int (__thiscall **)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))(*(_DWORD *)v42 + );
      __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)v42 + ));
      v16 = v15(v14);
      v12 = Windows::Rtl::SystemImplementation::CSystemIsolationLayer::GetProviders(v16, &v39, &v40, &v41);
      v4 = v42;
      if ( v12 <  )
      {
LABEL_19:
        v38 = v12;
        if ( v4 )
        {
          v42 = ;
          v13 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
          __guard_check_icall_fptr(**(_DWORD **)v4);
          v13(v4);
        }
        goto LABEL_69;
      }
      if ( v42 )
      {
        v42 = ;
        v17 = **(void (__thiscall ***)(struct Windows::Rtl::SystemImplementation::IRtlFileSystemProvider *))v4;
        __guard_check_icall_fptr(**(_DWORD **)v4);
        v17(v4);
      }
      v10 = v40;
      if ( !v40 )
      {
LABEL_76:
        if ( *((_DWORD *)v5 + ) <=  )
        {
          v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
          v8 = "ConstructorData->FilesystemLayers.Length > 0";
LABEL_33:
          Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
LABEL_49:
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
          goto LABEL_50;
        }
      }
      if ( !v39 && *((_DWORD *)v5 + ) <=  )
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
        v8 = "ConstructorData->RegistryLayers.Length > 0";
        goto LABEL_33;
      }
      if ( !v41 && *((_DWORD *)v5 + ) <=  )
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
        v8 = "ConstructorData->UserLayers.Length > 0";
        goto LABEL_33;
      }
      v18 = Windows::Rtl::SystemImplementation::CreateFilesystemProviderStack(v11, v10, (int)v5 + , (int *)&v40, &v28);
      if ( v18 <  )
        goto LABEL_68;
      v18 = Windows::Rtl::SystemImplementation::CreateRegistryProviderStack(v19, v39, (int)v5 + , &v39, &v28);
      if ( v18 <  )
        goto LABEL_68;
      v18 = Windows::Rtl::SystemImplementation::CreateUserProviderStack(v31, v41, v40, v39, (int)v5 + , (int *)&v41);
      if ( v18 <  )
        goto LABEL_68;
      goto LABEL_66;
    }
    v42 = ;
    v30 = ;
    v29 = ;
    if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider *>::Allocate(&v42) )
    {
      if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::Allocate(&v30) )
      {
        if ( Windows::Auto<Windows::Rtl::SystemImplementation::DirectUserProvider *>::Allocate(&v29) )
        {
          v20 = v30;
          v21 = Windows::Rtl::SystemImplementation::DirectRegistryProvider::Initialize(v30);
          if ( (signed int)v21 >=  )
          {
            v4 = v42;
            v24 = Windows::Rtl::SystemImplementation::DirectUserProvider::Initialize(v29, v22, v31, v42, v20, );
            if ( v24 >=  )
            {
              v40 = v4;
              v39 = v20;
              v41 = v29;
LABEL_66:
              v18 = Windows::Rtl::SystemImplementation::RtlGetTransactionCoordinator(
                      &v27,
                      (volatile signed __int32 *)v4);
              if ( v18 >=  )
              {
                v33 = (const char *)v40;
                v34 = (const char *)v39;
                v35 = v41;
                v37 = v28;
                v36 = v27;
                v18 = Windows::Rtl::CRtlOneShotTypeDescriptionInit<Windows::Rtl::SystemImplementation::CSystemIsolationLayer>::CreateInstance<Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff,Windows::Rtl::SystemImplementation::CreateSILSource,Windows::Rtl::IRtlSystemIsolationLayer>(
                        (const struct Windows::Rtl::SystemImplementation::CreateSILSource *)&v33,
                        v32);
                if ( v18 >=  )
                {
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
                  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
                  goto LABEL_73;
                }
              }
LABEL_68:
              v38 = v18;
              goto LABEL_69;
            }
            v38 = v24;
            if ( v29 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
            if ( v20 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
            if ( !v4 )
              goto LABEL_69;
            v23 = v4;
          }
          else
          {
            v38 = (int)v21;
            if ( v29 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
            if ( v20 )
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v20);
            v23 = v42;
            if ( !v42 )
              goto LABEL_69;
          }
          Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v23);
LABEL_69:
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v27);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v41);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v39);
          Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v40);
          goto LABEL_70;
        }
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
        v38 = -;
        v8 = "User.Allocate()";
        if ( v29 )
          Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v29);
      }
      else
      {
        v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
        v38 = -;
        v8 = "Reg.Allocate()";
      }
      if ( v30 )
        Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v30);
    }
    else
    {
      v7 = (Windows::Rtl::SystemImplementation::DirectUserProvider *);
      v38 = -;
      v8 = "Fs.Allocate()";
    }
    if ( v42 )
      Windows::Auto<Windows::Rtl::SystemImplementation::DirectRegistryProvider *>::DeleteInstance((void *)v42);
    goto LABEL_49;
  }
  v9 = Windows::Rtl::IRtlObject::CreateRequiredInterface<Windows::Rtl::IRtlSystemIsolationLayer>(
         (void *)Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest,
         a3);
  if ( v9 <  )
  {
    v38 = v9;
LABEL_70:
    Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>(
      (int)&v43,
      (int)v4);
    return v38;
  }
LABEL_73:
  v46 = ;
  v38 = ;
  Windows::WCP::Rtl::CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>::~CEnterExitTracer<Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame,>(
    (int)&v43,
    (int)v4);
  return ;
}
// 1027D610: using guessed type struct Windows::Rtl::IRtlSystemIsolationLayer *Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest;
           

繼續閱讀