OrcCommand: GetThis: move RegFlushKey to anonymous namespace

DFIR-ORC · Nov 9, 2020 · adeae8f · adeae8f
1 parent 0c81463
commit adeae8f
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 23 deletions.
diff --git a/src/OrcCommand/GetThis.h b/src/OrcCommand/GetThis.h
@@ -295,8 +295,6 @@ class ORCUTILS_API Main : public UtilitiesMain
 
     HRESULT FindMatchingSamples();
 
-    HRESULT RegFlushKeys();
-
 public:
     Main();
 

diff --git a/src/OrcCommand/GetThis_Run.cpp b/src/OrcCommand/GetThis_Run.cpp
@@ -415,36 +415,43 @@ LimitStatus SampleLimitStatus(const Limits& globalLimits, const Limits& localLim
     return SampleWithinLimits;
 }
 
-}  // namespace
-
-Main::Main(logger pLog)
-    : UtilitiesMain(pLog)
-    , config(pLog)
-    , FileFinder(pLog)
-    , ComputerName(::RetrieveComputerName(L"Default", pLog))
-{
-}
-
-HRESULT Main::RegFlushKeys()
+HRESULT RegFlushKeys(logger& _L_)
 {
     bool bSuccess = true;
     DWORD dwGLE = 0L;
 
     Log::Debug(L"Flushing HKEY_LOCAL_MACHINE");
     dwGLE = RegFlushKey(HKEY_LOCAL_MACHINE);
     if (dwGLE != ERROR_SUCCESS)
+    {
         bSuccess = false;
+    }
 
     Log::Debug(L"Flushing HKEY_USERS");
     dwGLE = RegFlushKey(HKEY_USERS);
     if (dwGLE != ERROR_SUCCESS)
+    {
         bSuccess = false;
+    }
 
     if (!bSuccess)
+    {
         return HRESULT_FROM_WIN32(dwGLE);
+    }
+
     return S_OK;
 }
 
+}  // namespace
+
+Main::Main(logger pLog)
+    : UtilitiesMain(pLog)
+    , config(pLog)
+    , FileFinder(pLog)
+    , ComputerName(::RetrieveComputerName(L"Default", pLog))
+{
+}
+
 HRESULT Main::ConfigureSampleStreams(SampleRef& sampleRef)
 {
     HRESULT hr = E_FAIL;
@@ -1225,6 +1232,7 @@ HRESULT Main::CloseOutput()
 HRESULT Main::Run()
 {
     HRESULT hr = E_FAIL;
+
     LoadWinTrust();
 
     GetSystemTimeAsFileTime(&CollectionDate);
@@ -1233,18 +1241,14 @@ HRESULT Main::Run()
     {
         if (config.bFlushRegistry)
         {
-            if (FAILED(hr = RegFlushKeys()))
-                log::Info(_L_, L"Failed to flush keys (hr = 0x%lx)\r\n", hr);
+            hr = ::RegFlushKeys();
+            if (FAILED(hr))
+            {
+                Log::Error(L"Failed to flush keys (code: {:#x})", hr);
+                return hr;
+            }
         }
-    }
-    catch (...)
-    {
-        log::Error(_L_, E_FAIL, L"GetThis failed during output setup, parameter output, RegistryFlush, exiting\r\n");
-        return E_FAIL;
-    }
 
-    try
-    {
         hr = InitOutput();
         if (FAILED(hr))
         {