Sysprep
Sysprep
//----- (10002AB0)--------------------------------------------------------
int __stdcall SqmSysprepCleanup()
{
CleanupAllWinSqmFiles();
return 0;
}
//----- (10002AC0)--------------------------------------------------------
LSTATUS __stdcall SqmSysprepGeneralize()
{
v0 =0;
v18 =(struct _SECURITY_ATTRIBUTES *)1;
v16 =0;
v1 =0;
v17 =0;
v19 =L"Software\\Microsoft\\SQMClient";
v20 =L"Software\\Microsoft\\SQMClient\\Windows";
v21 =L"Software\\Microsoft\\SQMClient\\Windows\\Uploader\\PendingUpload";
v22 =L"Software\\Microsoft\\SQMClient\\Windows\\Users";
v23 =L"Software\\Microsoft\\SQMClient\\Windows\\DisabledSessions";
v24 =L"Software\\Microsoft\\SQMClient\\Windows\\DisabledProcesses";
v25 =L"Software\\Microsoft\\SQMClient\\Windows\\CommonDatapoints";
v26 =L"Software\\Microsoft\\SQMClient\\Windows\\ServerSync";
v27 =L"Software\\Microsoft\\SQMClient\\Windows\\AdaptiveSQM\\ManifestInfo";
v28 =L"Software\\Microsoft\\SQMClient\\Windows\\AdaptiveSQM\\Throttling";
v29 =L"Software\\Microsoft\\SQMClient\\CommonUploader";
v30 =L"Software\\Microsoft\\SQMClient\\Windows\\Uploader";
RegSetSysprepKey();
if (RegGetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
&stru_1000164C,
(constunsigned __int16 *)&v18,
v6,
v11))
{
v18 =(struct _SECURITY_ATTRIBUTES *)1;
}
if (!RegGetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
&stru_10001664,
(constunsigned __int16 *)&v16,
v7,
v12))
v0 =1;
if (!RegGetDWordValue(L"Software\\Microsoft\\SQMClient",&stru_100016A0, (const unsigned __int16 *)&v17, v8, v13))
v1 =1;
v3 =0;
while (1 )
{
result =RegDeleteAllValues((int)v2, (&v19)[2 * v3]);
if (result )
break;
if ((unsigned int)++v3 >= 0xC )
{
if (!v1
||(result =RegSetDWordValue(
L"Software\\Microsoft\\SQMClient",
v2,
(const unsigned __int16 *)&stru_100016A0,
v17,
v9,
v14)) == 0 )
{
result =RegSetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
v2,
(const unsigned __int16 *)&stru_1000164C,
v18,
v9,
v14);
if ( !result )
{
if ( v0 )
result = RegSetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
v5,
(const unsigned __int16 *)&stru_10001664,
v16,
v10,
v15);
}
}
return result;
}
}
return result;
}
// 100011D0: using guessed type wchar_taSoftwareMicr_9[37];
// 10001220: using guessed type wchar_t aSoftwareMicr_8[60];
// 10001298: using guessed type wchar_taSoftwareMicr_2[43];
// 100012F0: using guessed type wchar_taSoftwareMicr_0[54];
// 10001360: using guessed type wchar_taSoftwareMic_10[55];
// 100013D0: using guessed type wchar_taSoftwareMicr_1[54];
// 10001440: using guessed type wchar_taSoftwareMicr_5[48];
// 100014A0: using guessed type wchar_taSoftwareMicr_7[62];
// 10001520: using guessed type wchar_taSoftwareMicr_3[60];
// 10001598: using guessed type wchar_taSoftwareMic_12[44];
// 100015F0: using guessed type wchar_taSoftwareMicros[46];
//----- (10002C10)--------------------------------------------------------
int __stdcall SqmSysprepSpecialize()
{
HRESULT v0; //eax@1
HRESULT v1; //esi@1
HKEY v2; //ecx@8
HKEY v4; //[sp-10h] [bp-38h]@0
const unsigned __int16*v5; //[sp-Ch] [bp-34h]@0
unsigned __int64 v6; // [sp+0h] [bp-28h]@0
const unsigned __int16*v7; //[sp+0h] [bp-28h]@1
const unsigned __int16*v8; //[sp+0h] [bp-28h]@6
unsigned __int32 *v9; // [sp+4h] [bp-24h]@1
unsigned __int32 v10; // [sp+4h] [bp-24h]@6
struct _SECURITY_ATTRIBUTES *v11; // [sp+8h][bp-20h]@1
int v12; // [sp+Ch] [bp-1Ch]@1
struct _FILETIMESystemTimeAsFileTime; // [sp+10h] [bp-18h]@1
int v14; // [sp+18h] [bp-10h]@1
int v15; // [sp+1Ch] [bp-Ch]@1
int v16; // [sp+20h] [bp-8h]@1
int v17; // [sp+24h] [bp-4h]@1
v14 =0;
SystemTimeAsFileTime.dwLowDateTime = 0;
v15 =0;
SystemTimeAsFileTime.dwHighDateTime = 0;
v12 =0;
v11 =0;
v16 =0;
v17 =0;
GetSystemTimeAsFileTime(&SystemTimeAsFileTime);
RegSetDWord64Value(
v4,
v5,
SystemTimeAsFileTime.dwLowDateTime,
(constunsigned __int16 *)SystemTimeAsFileTime.dwHighDateTime,
v6);
v0 =CoInitialize(0);
v1 =v0;
if (v0 >= 0|| v0 ==-2147417850)
{
CleanupAllWinSqmFiles();
if (!SqmReadSharedUserId((int)&v14) )
{
if (!SqmReadSharedUserId((int)&v14) )
goto LABEL_11;
SetLastError(0);
}
if ((RegGetDWordValue(
L"Software\\Microsoft\\ReliabilityAnalysis\\RAC",
&stru_10001700,
(constunsigned __int16 *)&v11,
v7,
v9)
||!v11)
&&CreateSamplingNumber((unsigned int*)&v11) >= 0
&&v11 )
{
RegSetDWordValue(
L"Software\\Microsoft\\ReliabilityAnalysis\\RAC",
v2,
(constunsigned __int16 *)&stru_10001700,
v11,
v8,
v10);
}
}
LABEL_11:
if (v1 >= 0)
CoUninitialize();
return 0;
}
//----- (10003E08)--------------------------------------------------------
LSTATUS __cdecl RegSetSysprepKey()
{
LSTATUS v0; //esi@1
HKEY phkResult; // [sp+4h] [bp-4h]@1
phkResult =0;
v0 =RegCreateKeyExW(
HKEY_LOCAL_MACHINE,
L"Software\\Microsoft\\SQMClient\\SysprepPerformed",
0,
0,
1u,
0x20106u,
0,
&phkResult,
0);
if (v0 && WPP_GLOBAL_Control != &WPP_GLOBAL_Control&& *((_BYTE *)WPP_GLOBAL_Control+ 28) & 1 )
WPP_SF_SD(
46,
(int)WPP_f9cefb2c04063ea30c4011796e605244_Traceguids,
*((_DWORD *)WPP_GLOBAL_Control +4),
*((_DWORD *)WPP_GLOBAL_Control +5),
L"Software\\Microsoft\\SQMClient\\SysprepPerformed",
v0);
if (phkResult )
RegCloseKey(phkResult);
return v0;
}