解读 SetupOfflineStoreEnvironment

解读 SetupOfflineStoreEnvironment

 

 

//----- (10120FFA)--------------------------------------------------------
int *__fastcallSetupOfflineStoreEnvironment(

// 是由 OFFLINE_STORE_CREATION_PARAMETERS转换后的CNtStoreCreationParameters

int a1,

int *a2) // IRtlSystemIsolationLayer

{

  v31 = a1;
// OA
  v32 =20;
  v33 =0;
  v34 =64;
  v35 =0;
  v36 =0;
  v51 =0;
  v53 =a2;  //IRtlSystemIsolationLayer
  v2 =*a2;
  v3 =0;
  v4 =a1 +28;  // LUNICODE_STRING，根目录，pszTargetWindowsDirectoryPath

// OpenFileSystemDirectory
  v5 =(*(int(__thiscall**)(int*, _DWORD,signed int, int,signed int, signed int, int *, _DWORD))(v2+8))(
         v53,
         0,
         1179785,
         v4,
         7,
         33,
         (int*)&v51, // IRtlFile
         0);
  if (v5 >=0)
  {
    v52 =0;
    v7 =CreateOrOpenExistingDirectory(v51,(int)g_LUNICODE_STRING_WinSxS, (int)&v52);
    if (v7 >=0)
    {
      v33 =g_LUNICODE_STRING_migration_dot_xml;
      v50 =0;
      v8 =v52;
      v9 =*v52;

// CreateNewFile
      v10 =(*(int(__thiscall**)(_DWORD*,signed int, signedint, int *, signedint, signed int, signed int, signed int,int *, int *))(v9+ 28))(
              v8,
              2,
              1179926,
              &v32,  // OA
              128,
              7,
              2,
              16480,
              &v50,   // IRtlFile
              &v42);
      if (v10 <0
        ||v42 == 1
        &&(v11=v50,

// SetContents
            v12 = *(int (__thiscall**)(int,_DWORD,const char *))(*(_DWORD*)v50+ 28),
            v10 = v12(v11,0, ")"),
            v10 < 0) )
      {
        v6 =(int*)ConvertNtStatusToHResult(v10);
        v53 =v6;
      }
      else
      {
        v48 =0;
        v13 =CreateOrOpenExistingDirectory(v52,(int)g_LUNICODE_STRING_Manifests, (int)&v48);
        if ( v13 >=0 )
        {
          v47 =0;
          v14 =CreateOrOpenExistingDirectory(v52,(int)g_LUNICODE_STRING_Catalogs, (int)&v47);
          if ( v14 >=0)
          {

// 以下处理注册表
            v46 =0;
            v15 = v53; // a2, IRtlSIL
            v16 = *v53;

// OpenRegistryKey
            v17 =(*(int(__thiscall**)(int*,signed int, signedint, int *, int *,int *))(v16+ 20))(
                    v15,
                    2,
                    983103,
                   g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_Microsoft_bslash_Windows_bslash_CurrentVersion_bslash_,
                    &v46,
                    &v42);
            if (v17 >=0)
            {
              v18 = *v15;
              v49 = 0;
              v19 = (*(int(__thiscall**)(int*,signed int,signed int, int *,int *,int *))(v18+20))(
                      v15,
                      2,
                      983103,
                     g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_COMPONENTS_bslash_,
                      &v49,
                      &v42);
              if ( v19 <0
                || (v19 = Windows::COM::VerifyOrWriteStoreVersion(
                            v49,
                            v15,
                            (Windows::COM *)*(_WORD*)(v31+ 184),
                            v28,
                            v29,
                            v30),
                    v19 <0) )
              {
                v6 = (int*)ConvertNtStatusToHResult(v19);
                v53 = v6;
              }

// 如果这八个键不存在，就创建
              else
              {
                v37 = 0;
                v38 = 0;
                v39 = 0;
                v40 = 0;
                v41 = 0;
                v43 = 0;
                v44 = 0;
                v45 = 0;
                v53 = (int*)&v54;
                v54 = &v49;  // IRtlKey \Components
                v55 = &v45;
                v56 =g_LUNICODE_STRING_CanonicalData;
                v57 = &v45;
                v58 = &v40;
                v59 =g_LUNICODE_STRING_Deployments;
                v60 = &v45;
                v61 = &v38;
                v62 = g_LUNICODE_STRING_Catalogs;
                v63 = &v49;
                v64 = &v43;
                v65 =g_LUNICODE_STRING_DerivedData;
                v66 = &v43;
                v67 = &v41;
                v68 = g_LUNICODE_STRING_Components;
                v69 = &v46;
                v70 = &v44;
                v71 = g_LUNICODE_STRING_SideBySide;
                v72 = &v44;
                v73 = &v39;
                v74 = g_LUNICODE_STRING_Winners;
                v75 = &v44;
                v76 = &v37;
                v77 = g_LUNICODE_STRING_Configuration;
                v20 = (int*)&v54;
                while ( 1 )
                {
                  v33 =(int*)v20[2];
                  v21 =(int**)*v20;
                  v34 =64;
                  v22 = *v21;
                  v23 = v20[1];
                  v24 = **v21;

// CreateNewKey
                  v25 =(*(int(__thiscall**)(int*,signed int,signed int, int *,signed int, int, int*))(v24+24))(
                          v22,
                          1,
                          131103,
                          &v32,
                          4,
                          v23,
                          &v42);

                  ++v3;
                  v20 =v53+ 3;
                  v53 +=3;

// 重复八次
                  if ( v3 == 8)
                  {
                    Windows::AutoPointerBase<IRtlCdfStringTableEnumerator*,Windows::Auto<IRtlCdfStringTableEnumerator*>>::Close(&v39);
::Close(&v44);
::Close(&v37);
::Close(&v41);
::Close(&v43);
::Close(&v38);
::Close(&v40);
::Close(&v45);
::Close(&v49);
::Close(&v46);
::Close(&v47);
::Close(&v48);
::Close(&v50);
::Close(&v52);
::Close(&v51);
                    return 0;
                  }
                }
                v6 = (int*)ConvertNtStatusToHResult(v25);
                v53 = v6;
                ::Close(&v39);
                ::Close(&v44);
                ::Close(&v37);
                ::Close(&v41);
                ::Close(&v43);
                ::Close(&v38);
                ::Close(&v40);
                ::Close(&v45);
              }
              ::Close(&v49);
            }
            else
            {
              v6 = (int*)ConvertNtStatusToHResult(v17);
              v53 = v6;
            }
            ::Close(&v46);
          }
          else
          {
            v6 = (int *)ConvertNtStatusToHResult(v14);
            v53 = v6;
          }
          ::Close(&v47);
        }
        else
        {
          v6 =(int*)ConvertNtStatusToHResult(v13);
          v53 =v6;
        }
        ::Close(&v48);
      }
      ::Close(&v50);
    }
    else
    {
      v6 =(int*)ConvertNtStatusToHResult(v7);
      v53 =v6;
    }
    ::Close(&v52);
  }
  else
  {
    v6 =(int*)ConvertNtStatusToHResult(v5);
    v53 =v6;
  }
  ::Close(&v51);
  CBaseFrame<CVoidRaiseFrame>::ReportErrorPropagation(
    &v53,
    v27);
  return v6;
}