Sysprep
//----- (10002AB0)--------------------------------------------------------
int __stdcall SqmSysprepCleanup()
{
CleanupAllWinSqmFiles();
return 0;
}
//----- (10002AC0)--------------------------------------------------------
LSTATUS __stdcall SqmSysprepGeneralize()
{
v0 =0;
v18 =(struct _SECURITY_ATTRIBUTES
*)1;
v16 =0;
v1 =0;
v17 =0;
v19 =L"Software\\Microsoft\\SQMClient";
v20 =L"Software\\Microsoft\\SQMClient\\Windows";
v21 =L"Software\\Microsoft\\SQMClient\\Windows\\Uploader\\PendingUpload";
v22 =L"Software\\Microsoft\\SQMClient\\Windows\\Users";
v23 =L"Software\\Microsoft\\SQMClient\\Windows\\DisabledSessions";
v24 =L"Software\\Microsoft\\SQMClient\\Windows\\DisabledProcesses";
v25 =L"Software\\Microsoft\\SQMClient\\Windows\\CommonDatapoints";
v26 =L"Software\\Microsoft\\SQMClient\\Windows\\ServerSync";
v27 =L"Software\\Microsoft\\SQMClient\\Windows\\AdaptiveSQM\\ManifestInfo";
v28 =L"Software\\Microsoft\\SQMClient\\Windows\\AdaptiveSQM\\Throttling";
v29 =L"Software\\Microsoft\\SQMClient\\CommonUploader";
v30 =L"Software\\Microsoft\\SQMClient\\Windows\\Uploader";
RegSetSysprepKey();
if (RegGetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
&stru_1000164C,
(constunsigned __int16
*)&v18,
v6,
v11))
{
v18 =(struct _SECURITY_ATTRIBUTES
*)1;
}
if (!RegGetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
&stru_10001664,
(constunsigned __int16
*)&v16,
v7,
v12))
v0 =1;
if (!RegGetDWordValue(L"Software\\Microsoft\\SQMClient",&stru_100016A0,
(const unsigned __int16
*)&v17, v8, v13))
v1 =1;
v3 =0;
while (1
)
{
result =RegDeleteAllValues((int)v2,
(&v19)[2
* v3]);
if (result
)
break;
if ((unsigned int)++v3
>=
0xC )
{
if (!v1
||(result
=RegSetDWordValue(
L"Software\\Microsoft\\SQMClient",
v2,
(const unsigned __int16
*)&stru_100016A0,
v17,
v9,
v14)) ==
0 )
{
result =RegSetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
v2,
(const unsigned __int16
*)&stru_1000164C,
v18,
v9,
v14);
if ( !result
)
{
if ( v0
)
result = RegSetDWordValue(
L"Software\\Microsoft\\SQMClient\\Windows",
v5,
(const unsigned __int16
*)&stru_10001664,
v16,
v10,
v15);
}
}
return result;
}
}
return result;
}
// 100011D0: using guessed type wchar_taSoftwareMicr_9[37];
// 10001220: using guessed type wchar_t aSoftwareMicr_8[60];
// 10001298: using guessed type wchar_taSoftwareMicr_2[43];
// 100012F0: using guessed type wchar_taSoftwareMicr_0[54];
// 10001360: using guessed type wchar_taSoftwareMic_10[55];
// 100013D0: using guessed type wchar_taSoftwareMicr_1[54];
// 10001440: using guessed type wchar_taSoftwareMicr_5[48];
// 100014A0: using guessed type wchar_taSoftwareMicr_7[62];
// 10001520: using guessed type wchar_taSoftwareMicr_3[60];
// 10001598: using guessed type wchar_taSoftwareMic_12[44];
// 100015F0: using guessed type wchar_taSoftwareMicros[46];
//----- (10002C10)--------------------------------------------------------
int __stdcall SqmSysprepSpecialize()
{
HRESULT v0; //eax@1
HRESULT v1; //esi@1
HKEY v2; //ecx@8
HKEY v4; //[sp-10h] [bp-38h]@0
const unsigned __int16*v5;
//[sp-Ch] [bp-34h]@0
unsigned __int64 v6; // [sp+0h] [bp-28h]@0
const unsigned __int16*v7;
//[sp+0h] [bp-28h]@1
const unsigned __int16*v8;
//[sp+0h] [bp-28h]@6
unsigned __int32 *v9;
// [sp+4h] [bp-24h]@1
unsigned __int32 v10; // [sp+4h] [bp-24h]@6
struct _SECURITY_ATTRIBUTES *v11;
// [sp+8h][bp-20h]@1
int v12; // [sp+Ch] [bp-1Ch]@1
struct _FILETIMESystemTimeAsFileTime; // [sp+10h] [bp-18h]@1
int v14; // [sp+18h] [bp-10h]@1
int v15; // [sp+1Ch] [bp-Ch]@1
int v16; // [sp+20h] [bp-8h]@1
int v17; // [sp+24h] [bp-4h]@1
v14 =0;
SystemTimeAsFileTime.dwLowDateTime =
0;
v15 =0;
SystemTimeAsFileTime.dwHighDateTime =
0;
v12 =0;
v11 =0;
v16 =0;
v17 =0;
GetSystemTimeAsFileTime(&SystemTimeAsFileTime);
RegSetDWord64Value(
v4,
v5,
SystemTimeAsFileTime.dwLowDateTime,
(constunsigned __int16
*)SystemTimeAsFileTime.dwHighDateTime,
v6);
v0 =CoInitialize(0);
v1 =v0;
if (v0 >=
0|| v0
==-2147417850)
{
CleanupAllWinSqmFiles();
if (!SqmReadSharedUserId((int)&v14)
)
{
if (!SqmReadSharedUserId((int)&v14)
)
goto LABEL_11;
SetLastError(0);
}
if ((RegGetDWordValue(
L"Software\\Microsoft\\ReliabilityAnalysis\\RAC",
&stru_10001700,
(constunsigned __int16
*)&v11,
v7,
v9)
||!v11)
&&CreateSamplingNumber((unsigned int*)&v11)
>=
0
&&v11
)
{
RegSetDWordValue(
L"Software\\Microsoft\\ReliabilityAnalysis\\RAC",
v2,
(constunsigned __int16
*)&stru_10001700,
v11,
v8,
v10);
}
}
LABEL_11:
if (v1 >=
0)
CoUninitialize();
return 0;
}
//----- (10003E08)--------------------------------------------------------
LSTATUS __cdecl RegSetSysprepKey()
{
LSTATUS v0; //esi@1
HKEY phkResult; // [sp+4h] [bp-4h]@1
phkResult =0;
v0 =RegCreateKeyExW(
HKEY_LOCAL_MACHINE,
L"Software\\Microsoft\\SQMClient\\SysprepPerformed",
0,
0,
1u,
0x20106u,
0,
&phkResult,
0);
if (v0 && WPP_GLOBAL_Control
!=
&WPP_GLOBAL_Control&&
*((_BYTE
*)WPP_GLOBAL_Control+
28) &
1 )
WPP_SF_SD(
46,
(int)WPP_f9cefb2c04063ea30c4011796e605244_Traceguids,
*((_DWORD
*)WPP_GLOBAL_Control
+4),
*((_DWORD
*)WPP_GLOBAL_Control
+5),
L"Software\\Microsoft\\SQMClient\\SysprepPerformed",
v0);
if (phkResult
)
RegCloseKey(phkResult);
return v0;
}