PipInitDeviceOverrideCache

NTSTATUS __stdcall PipInitDeviceOverrideCache(){
  NTSTATUS v0; 
  NTSTATUS Key; 
  unsigned int v2; 
  __int64 *v3; 
  unsigned int v4; 
  VOID **PoolWithTag; 
  __int64 v6; 
  unsigned int i; 
  NTSTATUS v8; 
  VOID **v10; 
  _UNICODE_STRING *v11; 
  NTSTATUS v12; 
  unsigned int v13; 
  __int64 v14; 
  _UNICODE_STRING **v15; 
  UINT64 *ResultLength; 
  UINT64 HashValue; 
  VOID *Handle; 
  _UNICODE_STRING KeyName; 
  _QWORD KeyInformation[6]; 
  char v21[12]; 
  unsigned int v22; 
  __int16 SourceString[264]; 

  *(_QWORD *)&KeyName.Length = 8781956i64;
  Handle = 0i64;
  HashValue = 0i64;
  KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\DeviceOverrides";
  memset(KeyInformation, 0, sizeof(KeyInformation));
  v0 = IopOpenRegistryKeyEx(&Handle, 0i64, &KeyName, 0x20019ui64);
  Key = v0;
  if( v0 == -1073741772 )
    goto LABEL_17;
  if( v0 < 0 )
    goto LABEL_18;
  Key = ZwQueryKey(Handle, KeyFullInformation, KeyInformation, 0x30ui64, (UINT64 *)((char *)&HashValue + 4));
  if( (int)(Key + 0x80000000) >= 0 && Key != -2147483643 )
    goto LABEL_18;
  if( !HIDWORD(KeyInformation[2]) )
  {
LABEL_17:
    Key = 0;
    goto LABEL_18;
  }
  v2 = 0;
  v3 = qword_14001F378;
  while( HIDWORD(KeyInformation[2]) >= 3 * *(_DWORD *)v3 )
  {
    ++v2;
    v3 = (__int64 *)((char *)v3 + 4);
    if( v2 >= 3 )
      goto LABEL_8;
  }
  dword_140C50A28 = *(_DWORD *)v3;
LABEL_8:
  v4 = dword_140C50A28;
  if( !dword_140C50A28 )
  {
    v4 = 257;
    dword_140C50A28 = 257;
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 16i64 * v4, 1852403792i64);
  qword_140C50A20 = (__int64)PoolWithTag;
  if( PoolWithTag )
  {
    if( dword_140C50A28 )
    {
      v6 = dword_140C50A28;
      do
      {
        PoolWithTag[1] = PoolWithTag;
        *PoolWithTag = PoolWithTag;
        PoolWithTag += 2;
        --v6;
      }
      while( v6 );
    }
    for( i = 0; ; ++i )
    {
      LODWORD(ResultLength) = 536;
      v8 = ZwEnumerateKey(Handle, i, KeyBasicInformation, v21, (UINT64)ResultLength, (UINT64 *)((char *)&HashValue + 4));
      Key = v8;
      if( v8 >= 0 )
      {
        if( v22 <= 0x200 )
        {
          SourceString[(unsigned __int64)v22 >> 1] = 0;
          v10 = ExAllocatePoolWithTag(1ui64, 0x20ui64, 1852403792i64);
          v11 = (_UNICODE_STRING *)v10;
          if( !v10 )
            goto LABEL_34;
          if( !RtlCreateUnicodeString((INT64)(v10 + 2), (INT8 *)SourceString) )
          {
            Key = -1073741670;
            ExFreePoolWithTag(v11, 0);
            goto LABEL_18;
          }
          v12 = RtlHashUnicodeString(v11 + 1, 1u, 0i64, &HashValue);
          v13 = HashValue;
          if( v12 < 0 )
            v13 = 0;
          LODWORD(HashValue) = v13;
          v14 = qword_140C50A20 + 16i64 * (v13 % dword_140C50A28);
          v15 = *(_UNICODE_STRING ***)(v14 + 8);
          if( *v15 != (_UNICODE_STRING *)v14 )
            __fastfail(3u);
          *(_QWORD *)&v11->Length = v14;
          v11->Buffer = (wchar_t *)v15;
          *v15 = v11;
          *(_QWORD *)(v14 + 8) = v11;
        }
      }
      else
      {
        if( v8 == -2147483622 )
          goto LABEL_17;
        if( v8 != -2147483643 )
          goto LABEL_18;
      }
    }
  }
  dword_140C50A28 = 0;
LABEL_34:
  Key = -1073741670;
LABEL_18:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return Key;
}

Referenced by: