解析 GetRerootedSIL
GetRerootedSIL(
class`anonymous namespace'::CNtStoreCreationParameters const &,
classWindows::Auto<struct Windows::Rtl::IRtlSystemIsolationLayer *> *)
//----- (1011F3CE)-------------------------------------------------------- GetRerootedSIL(a1, a2) v2 a1; v55 a2; v63 a1; Windows::ErrorHandling::COM::CSimpleHResultCarryingFrame::CSimpleHResultCarryingFrame((Windows::ErrorHandling::COM::CSimpleHResultCarryingFrame)v149); v3 0; v101 0; v102 0; v103 0; v60 0; v61 0; v62 0; v4 RtlSplitLUnicodeString(2, v2 16, 0, 0, 0x5Cu, ()v101,()v60); (v4 0 (v57 0, v58 0, v59 0, v60 0, v61 0, v62 0, v56 v2 28,，根目录，pszTargetWindowsDirectoryPath v4 RtlSplitLUnicodeString(2, v2 28, 0, 0, 0x5Cu, ()v57,()v60), v4 0) (v60 0, v61 0, v62 0, v104 0, v105 0, v106 0, v4 RtlSplitLUnicodeString(1, ()v57,0, 0, 0x3Au, ()v60, ()v104), v4 0) ) (v60 v57 ) v60 2; v61 v58; v234 dword_10012008[0]; v235 dword_10012008[1]; v236 dword_10012008[2]; v237 (_DWORD)(v63 160); v238 (_DWORD)(v63 164); v239 (_DWORD)(v63 168); v240 v57; v241 v58; v242 v59; v243 v101; v244 v102; v245 v103; v246 dword_10028E3C[0]; v247 dword_10028E3C[1]; v248 dword_10028E3C[2]; v249 (_DWORD)(v63 4); v250 (_DWORD)(v63 8); v251 (_DWORD)(v63 12); v252 g_LUNICODE_STRING__bslash_SystemRoot_bslash_[0]; v253 g_LUNICODE_STRING__bslash_SystemRoot_bslash_[1]; v254 g_LUNICODE_STRING__bslash_SystemRoot_bslash_[2]; v255 (_DWORD)(v63 16); v256 (_DWORD)(v63 20); v257 (_DWORD)(v63 24); v6 Windows::Rtl::AutoString_LUNICODE_STRING,Windows::Auto_LUNICODE_STRING::IsEmpty(v63 160); v101 4 (v6 0); v100 v258 6 v101; v102 0; v103 0; v72 v258 6 v101; v73 4 (v6 0); v74 0; v75 0; v338 0; v339 0; v340 0; v341 0; v343 16; v344 16; v345 ()v72; v342 1; v148 0; v7 RtlGetSystem(0,0, v148); (v7 0) v8 v63; v9 (_DWORD)(v63 68); v10 v9 18; (v9 18 v9 v10 0x12) v144 0; v145 0; v146 0; v11 RtlAllocateLUnicodeString(v10, ()v144); (v11 0 (v54 ()(v8 64), v11 RtlCopyLUnicodeString(v8 64, ()v144),v11 0) (v11 RtlAppendLUnicodeStringToLUnicodeString(()g_LUNICODE_STRING__bslash_Select_bslash_, ()v144),v11 0) ) v12 v148; v147 0; v13 (_DWORD)v148; v14 (( (__thiscall)(,_DWORD, , ,, _DWORD))(v13 20))( v12, 0, 131097, v144, v147, 0); (v14 0) v15 v147; v84 0; v139 0; v138 0; v140 0; v16 (_DWORD)v147; __guard_check_icall_fptr((_DWORD )((_DWORD )v147 56)); v17 (( (__thiscall)(,_DWORD, , ,, ))(v16 56))( v15, 0, g_LUNICODE_STRING_Current, 1, v138, v84); v141 0; v142 0; v143 0; v18 (_DWORD)(v140(_DWORD )(v140 8)); v19 RtlAllocateLUnicodeString(0x26u, ()v141); v20 v18; v21 v143; v22 StringCbPrintfW(v143, v142, L"\\%.*ls%03lu", 22,L"\\ControlSet", v20); v23 ()(v21 1); v24 v21; v21; (v24 ); v25 2 ((()v21 v23) 1); v141 v25; v26 v54 v25; (v26 v54 v26 v25 (v27 v26 2, v26 2 v26) v27 2) v135 0; v136 0; v137 0; v28 RtlAllocateLUnicodeString(v27, ()v135); (v28 0 (v28 RtlCopyLUnicodeString(()v54, ()v135), v28 0) (v28 RtlAppendLUnicodeStringToLUnicodeString(()v141,()v135),v28 0) (v28 RtlAppendLUnicodeStringToLUnicodeString(()g_LUNICODE_STRING__bslash_,()v135),v28 0) (v28 RtlSplitLUnicodeString(2, v63 124, 0, 0, 0x2Fu, ()v104,()v101),v28 0) (v28 RtlSplitLUnicodeString(2, ()v104,0, 0, 0x2Fu, ()v88, ()v101), v28 0) ) v150 dword_10012014[0]; v151 dword_10012014[1]; v152 dword_10012014[2]; v153 (_DWORD)(v63 172); v154 (_DWORD)(v63 176); v155 (_DWORD)(v63 180); v156 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_[0]; v157 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_[1]; v158 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_[2]; v159 (_DWORD)(v63 52); v160 (_DWORD)(v63 56); v161 (_DWORD)(v63 60); v162 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_CurrentControlSet_bslash_[0]; v163 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_CurrentControlSet_bslash_[1]; v164 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_CurrentControlSet_bslash_[2]; v165 v135; v166 v136; v167 v137; v168 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_[0]; v169 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_[1]; v170 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SYSTEM_bslash_[2]; v171 (_DWORD)(v63 64); v172 (_DWORD)(v63 68); v173 (_DWORD)(v63 72); v174 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_DRIVERS_bslash_[0]; v175 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_DRIVERS_bslash_[1]; v176 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_DRIVERS_bslash_[2]; v177 (_DWORD)(v63 40); v178 (_DWORD)(v63 44); v179 (_DWORD)(v63 48); v180 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SECURITY_bslash_[0]; v181 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SECURITY_bslash_[1]; v182 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SECURITY_bslash_[2]; v183 (_DWORD)(v63 76); v184 (_DWORD)(v63 80); v185 (_DWORD)(v63 84); v186 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SAM_bslash_[0]; v187 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SAM_bslash_[1]; v188 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SAM_bslash_[2]; v189 (_DWORD)(v63 88); v190 (_DWORD)(v63 92); v191 (_DWORD)(v63 96); v192 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_COMPONENTS_bslash_[0]; v193 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_COMPONENTS_bslash_[1]; v194 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_COMPONENTS_bslash_[2]; v195 (_DWORD)(v63 100); v196 (_DWORD)(v63 104); v197 (_DWORD)(v63 108); v198 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash__dot_DEFAULT_bslash_[0]; v199 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash__dot_DEFAULT_bslash_[1]; v200 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash__dot_DEFAULT_bslash_[2]; v201 (_DWORD)(v63 112); v202 (_DWORD)(v63 116); v203 (_DWORD)(v63 120); v204 (_DWORD)"0"; v205 (_DWORD)g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_Template_bslash_[4]; v206 (_DWORD)g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_Template_bslash_[8]; v207 (_DWORD)(v63 124); v208 (_DWORD)(v63 128); v209 (_DWORD)(v63 132); v210 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_Schema_bslash_[0]; v211 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_Schema_bslash_[1]; v212 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_Schema_bslash_[2]; v213 (_DWORD)(v63 136); v214 (_DWORD)(v63 140); v215 (_DWORD)(v63 144); v216 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_BCD_bslash_[0]; v217 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_BCD_bslash_[1]; v218 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_BCD_bslash_[2]; v219 (_DWORD)(v63 148); v220 (_DWORD)(v63 152); v221 (_DWORD)(v63 156); v222 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[0]; v223 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[1]; v224 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[2]; v225 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[0]; v226 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[1]; v227 g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_[2]; v228 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_[0]; v229 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_[1]; v230 g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_[2]; v231 v88; v232 v89; v233 v90; v346 0; v347 0; v348 0; v349 0; v351 16; v352 16; v350 1; v353 ()v76; v66 ()v56; v67 (_DWORD)(v56 4); v68 ()(v56 8); v69 0; v70 0; v71 0; v76 v150; v77 14; v78 0; v79 0; v29 ()v66; (()v66 2 Windows::WCP::Implementation::Rtl::LastCharacter(()v66) 92 ) v66 ()(v29 2); v132 0; v133 0; v134 0; v69 g_LUNICODE_STRING__bslash_System32_bslash_Drivers_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_System32_bslash_Drivers_bslash_[1]; v71 g_LUNICODE_STRING__bslash_System32_bslash_Drivers_bslash_[2]; v30 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v132); v31 g_LUNICODE_STRING__bslash_System32_bslash_Drivers_bslash_; ((_WORD)(v63 184) ) v31 g_LUNICODE_STRING__bslash_SysWOW64_bslash_Drivers_bslash_; v69 v31; v32 ()(v31 1); v129 0; v70 ()v32; v130 0; v71 (_DWORD)(v32 4); v131 0; v33 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v129); v126 0; v127 0; v128 0; v69 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_Drivers_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_SysWOWArm_bslash_Drivers_bslash_[1]; v71 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_Drivers_bslash_[2]; v34 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v126); v123 0; v124 0; v125 0; v69 g_LUNICODE_STRING__bslash_Fonts_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_Fonts_bslash_[1]; v71 g_LUNICODE_STRING__bslash_Fonts_bslash_[2]; v35 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v123); v120 0; v121 0; v122 0; v69 g_LUNICODE_STRING__bslash_Inf_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_Inf_bslash_[1]; v71 g_LUNICODE_STRING__bslash_Inf_bslash_[2]; v36 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v120); v117 0; v118 0; v119 0; v69 g_LUNICODE_STRING__bslash_Mui_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_Mui_bslash_[1]; v71 g_LUNICODE_STRING__bslash_Mui_bslash_[2]; v37 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v117); v114 0; v115 0; v116 0; v69 g_LUNICODE_STRING__bslash_Help_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_Help_bslash_[1]; v71 g_LUNICODE_STRING__bslash_Help_bslash_[2]; v38 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v114); v110 0; v111 0; v112 0; v69 g_LUNICODE_STRING__bslash_System_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_System_bslash_[1]; v71 g_LUNICODE_STRING__bslash_System_bslash_[2]; v39 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v110); v107 0; v108 0; v109 0; v69 g_LUNICODE_STRING__bslash_System32_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_System32_bslash_[1]; v71 g_LUNICODE_STRING__bslash_System32_bslash_[2]; v40 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v107); v97 0; v98 0; v99 0; v69 g_LUNICODE_STRING__bslash_SysWOW64_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_SysWOW64_bslash_[1]; v71 g_LUNICODE_STRING__bslash_SysWOW64_bslash_[2]; v41 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v97); v91 0; v92 0; v93 0; v69 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_SysWOWArm_bslash_[1]; v71 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_[2]; v42 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v91); v94 0; v95 0; v96 0; v69 g_LUNICODE_STRING__bslash_Program_space_Files_space__lparen_Arm_rparen__bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_Program_space_Files_space__lparen_Arm_rparen__bslash_[1]; v71 g_LUNICODE_STRING__bslash_Program_space_Files_space__lparen_Arm_rparen__bslash_[2]; v43 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v94); v85 0; v86 0; v87 0; v69 g_LUNICODE_STRING__bslash_system32_bslash_wbem_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_system32_bslash_wbem_bslash_[1]; v71 g_LUNICODE_STRING__bslash_system32_bslash_wbem_bslash_[2]; v44 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v85); v45 g_LUNICODE_STRING__bslash_system32_bslash_wbem_bslash_; ((_WORD)(v63 184) ) v45 g_LUNICODE_STRING__bslash_syswow64_bslash_wbem_bslash_; v69 v45; v70 ()v46; v71 (_DWORD)(v46 4); v88 0; v89 0; v90 0; v46 ()(v45 1); v47 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v88); v104 0; v105 0; v106 0; v69 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_wbem_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_SysWOWArm_bslash_wbem_bslash_[1]; v71 g_LUNICODE_STRING__bslash_SysWOWArm_bslash_wbem_bslash_[2]; v48 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v104); v101 0; v102 0; v103 0; v69 g_LUNICODE_STRING__bslash_AppPatch_bslash_[0]; v70 ()g_LUNICODE_STRING__bslash_AppPatch_bslash_[1]; v71 g_LUNICODE_STRING__bslash_AppPatch_bslash_[2]; v49 RtlConcatenateLUnicodeStrings(0, 2u, v66,()v101); v258 36; v259 ()v56; v260 (_DWORD)(v56 4); v261 (_DWORD)(v56 8); v262 37; v263 v107; v264 v108; v265 v109; v266 41; v267 v97; v268 v98; v269 v99; v270 0x2 0000; v271 v132; v272 v133; v273 v134; v274 0xE 0000; // 917504; v275 v129; v276 v130; v277 v131; v278 20; v279 v123; v280 v124; v281 v125; v282 0x3 0000; // 196608; v283 v120; v284 v121; v285 v122; v286 0x4 0000; v287 v117; v288 v118; v289 v119; v290 0xA 0000; // 655360; v291 v114; v292 v115; v293 v116; v294 0x5 0000; // 327680; v295 v110; v296 v111; v297 v112; v298 0x7 0000; // 458752; v299 v85; v300 v86; v301 v87; v302 0xF 0000; // 983040; v303 v88; v304 v89; v305 v90; v306 0x1 0000; v307 v60; v308 v61; v309 v62; v310 0x10 0000; v311 v57; v312 v58; v313 v59; v314 0xB 0000; // 720896; v315 v101; v316 v102; v317 v103; v318 0x3F 0000; // 4128768; v319 v91; v320 v92; v321 v93; v322 0x40 0000; v323 v94; v324 v95; v325 v96; v326 0x41 0000; // 4259840; v327 v94; v328 v95; v329 v96; v330 0x42 0000; // 4325376; v331 v126; v332 v127; v333 v128; v334 0x43 0000; // 4390912; v335 v104; v336 v105; v337 v106; v362 0; v363 v258; v364 20; v80 0; v81 0; v82 v362; v83 1; v113 0; v50 BuildEnvironmentBlockFromMappings(()v82,(PVOID )v113); v354 0; v355 4; v356 4; v357 v64; v358 1; v359 16; v360 16; v361 v80; v52 (_WORD)(v63 184); v64 v113; v65 0; v66 v338; v68 v346; v67 2; v69 2; v70 v354; v71 2; ((_WORD)v52 ) ( v52 ) 5: v3 4; ; 12: v3 8; ; 6: 9: v3 2; ; v3 1; v50 ()RtlGetSystem(v3,(Windows::WCP::Rtl::_RTL_TRACING_FACILITY )v65,v55); v51 v149; Windows::ErrorHandling::Rtl::CBaseFrameWindows::ErrorHandling::Rtl::CVoidRaiseFrame::SetCanonicalSuccess(v149); Windows::WCP::Implementation::Rtl::AutoEnvironment::AutoEnvironment((Windows::WCP::Implementation::Rtl::AutoEnvironment)v113); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v101); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v104); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v88); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v85); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v94); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v91); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v97); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v107); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v110); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v114); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v117); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v120); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v123); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v126); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v129); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v132); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v135); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v141); Windows::Auto_LBLOB::Auto_LBLOB(v138); Windows::AutoWindows::Rtl::IRtlSystemIsolationLayer ::AutoWindows::Rtl::IRtlSystemIsolationLayer (v147); Windows::Auto_LUTF8_STRING::Auto_LUTF8_STRING(v144); Windows::AutoWindows::Rtl::IRtlSystemIsolationLayer ::AutoWindows::Rtl::IRtlSystemIsolationLayer (v148); v149;