PiDcInitUpdateProperties

NTSTATUS __stdcall PiDcInitUpdateProperties(){
  VOID **PoolWithTag; 
  INT64 v1; 
  NTSTATUS v2; 
  int v3; 
  unsigned int v4; 
  UINT64 i; 
  NTSTATUS v6; 
  INT64 v7; 
  _WORD *v8; 
  int v9; 
  UINT64 j; 
  NTSTATUS v11; 
  INT64 Length; 
  UINT64 Lengtha; 
  INT64 Lengthb; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  UINT64 v18; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _GUID Guid; 
  UINT64 Value; 
  _GUID Buffer; 
  __int64 v26; 

  KeyHandle = 0i64;
  Handle = 0i64;
  LODWORD(v18) = 0;
  LODWORD(Value) = 0;
  v26 = 0i64;
  DestinationString = 0i64;
  Guid = 0i64;
  Buffer = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x218ui64, 1198550608i64);
  if( PoolWithTag )
  {
    RtlInitUnicodeString(
      &DestinationString,
      L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainerPropertyUpdateEvents");
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    v2 = ZwOpenKey(&KeyHandle, 8ui64, &ObjectAttributes, v1, Length, (INT64)ResultLength, v18, (INT64)Handle);
    v3 = v2;
    if( v2 != -1073741772 )
    {
      if( v2 < 0 )
        goto LABEL_24;
      v4 = 0;
      for( i = 0i64; ; i = v4 )
      {
        LODWORD(Lengtha) = 536;
        v6 = ZwEnumerateKey(KeyHandle, i, KeyBasicInformation, PoolWithTag, Lengtha, &v18);
        v3 = v6;
        if( v6 == -2147483622 )
          break;
        if( v6 < 0 )
          goto LABEL_24;
        *(&ObjectAttributes.Length + 1) = 0;
        v8 = PoolWithTag + 2;
        memset(&ObjectAttributes.Attributes + 1, 0, 20);
        DestinationString.Buffer = (wchar_t *)(PoolWithTag + 2);
        DestinationString.Length = *((_WORD *)PoolWithTag + 6);
        DestinationString.MaximumLength = DestinationString.Length;
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        v3 = ZwOpenKey(&Handle, 0x20019ui64, &ObjectAttributes, v7, Lengthb, (INT64)ResultLengtha, v18, 0i64);
        if( v3 < 0 )
          goto LABEL_24;
        v9 = 0;
        for( j = 0i64; ; j = (unsigned int)++v9 )
        {
          LODWORD(Lengtha) = 536;
          v11 = ZwEnumerateValueKey(Handle, j, KeyValueFullInformation, PoolWithTag, Lengtha, &v18);
          v3 = v11;
          if( v11 == -2147483622 )
          {
            v3 = 0;
            goto LABEL_21;
          }
          if( v11 != -2147483643 )
          {
            if( v11 < 0 )
              goto LABEL_21;
            if( (unsigned int)(*(_DWORD *)v8 - 80) <= 0x12 )
            {
              *(_DWORD *)&DestinationString.Length = 4980812;
              DestinationString.Buffer = (wchar_t *)PoolWithTag + 10;
              if( RtlGUIDFromString(&DestinationString, &Guid) >= 0 )
              {
                DestinationString.Buffer = (wchar_t *)PoolWithTag + 49;
                DestinationString.Length = *v8 - 78;
                DestinationString.MaximumLength = DestinationString.Length;
                if( RtlUnicodeStringToInteger(&DestinationString, 0xAui64, &Value) >= 0 )
                {
                  LODWORD(v26) = Value;
                  Buffer = Guid;
                  if( *((_DWORD *)PoolWithTag + 1) == 4 && *((_DWORD *)PoolWithTag + 3) == 4 )
                    HIDWORD(v26) = *(_DWORD *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
                  else
                    HIDWORD(v26) = 0;
                  if( !RtlInsertElementGenericTableAvl(
                          (_RTL_AVL_TABLE *)((char *)&PnpReplaceEvent + 1952),
                          &Buffer,
                          0x18ui64,
                          0i64) )
                    break;
                }
              }
            }
          }
        }
        v3 = -1073741670;
LABEL_21:
        ZwClose((_HANDLE)Handle);
        Handle = 0i64;
        if( v3 < 0 )
          goto LABEL_24;
        ++v4;
      }
    }
    v3 = 0;
  }
  else
  {
    v3 = -1073741670;
  }
LABEL_24:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x47706E50u);
  return v3;
}

Referenced by: