Trying to reverse engineer CmpFindNlsData of winload

Question

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is loaded when Windows boots up. I have been able to figure out the algorithm to this point.

CmpFindNlsData
{
HvpGetCellPaged();
push offset winload!CmpControlString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpNlsString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpCodePageString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpAcpString
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpOemCpString
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();
}

Answer 1

As i Commented the query is vague anyway just took a look and it doesn't seem to be overly complicated

all this function seem to do is retrieve a few key values from registry

basically it runs a loop like

while (string) { Create An Unicode string open regkey->onfail return false get regvalue->onfail return false got to next string } return true

these are the strings it accesses in win7 x86

C:\>cdb -c "uf winload!CmpFindNlsData;q" -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode
0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)
00465121 8d4df0          lea     ecx,[ebp-10h]
00465124 e88d28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)
00465149 8d4df0          lea     ecx,[ebp-10h]
0046514c e86528fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)
00465174 8d4df0          lea     ecx,[ebp-10h]
00465177 e83a28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)
004651a3 8d4df0          lea     ecx,[ebp-10h]
004651a6 e80b28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)
0046526f 8d4df0          lea     ecx,[ebp-10h]
00465272 e83f27fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)
0046533e 8d4df0          lea     ecx,[ebp-10h]
00465341 e87026fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)
00465370 8d4df0          lea     ecx,[ebp-10h]
00465373 e83e26fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)
0046543d 8d4df0          lea     ecx,[ebp-10h]
00465440 e87125fcff      call    winload!RtlInitUnicodeString (004279b6)

C:\>cdb -c "uf winload!CmpFindNlsData;q" -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode | grep PBO
0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)
00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)
0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)
0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)
0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)
00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)
0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)
00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)


C:\>cdb -c "du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q" -z c:\Windows\System32\winload.exe | awk "/Reading/,/quit/"
0:000> cdb: Reading initial command 'du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q'
00465c40  "Control"
00465cb0  "NLS"
00465cc0  "CodePage"
00465ce0  "ACP"
00465cf0  "OEMCP"
00465d00  "Language"
00465d20  "Default"
00465d30  "OEMHAL"
quit:

and these keys exist in hklm\system\currentcontrolset

C:\>reg query hklm\system\currentcontrolset\control\nls\codepage /v *cp*

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\nls\codepage
    ACP    REG_SZ    1252
    OEMCP    REG_SZ    437
    MACCP    REG_SZ    10000

End of search: 3 match(es) found.

after finding these it returns the c_1252.nls, etc filenames in the respective out parameters