WmipQuerySingleMultiple

NTSTATUS __stdcall WmipQuerySingleMultiple(
        _IRP *Irp,
        INT8 AccessMode,
        UINT8 *BufferPtr,
        UINT64 BufferSize,
        WMIQSIMULTIPLE *QsiMultiple,
        UINT64 QueryCount,
        _WMIGUIDOBJECT **ObjectList,
        _UNICODE_STRING *InstanceNames,
        UINT64 *ReturnSize){
  UINT8 *v9; 
  NTSTATUS v10; 
  _WMIGUIDOBJECT **v11; 
  VOID **PoolWithTag; 
  VOID **v13; 
  int v14; 
  char v15; 
  _WNODE_HEADER *v16; 
  VOID **v17; 
  unsigned int v18; 
  unsigned int v19; 
  unsigned __int16 Length; 
  unsigned int v21; 
  _DWORD *Wnode; 
  VOID *v23; 
  _KPROCESSOR_MODE v24; 
  int v25; 
  __int64 i; 
  __int64 v27; 
  __int64 v28; 
  UINT8 *v29; 
  int v30; 
  UINT64 OutBufferSize; 
  char v33; 
  unsigned __int16 v35; 
  UINT64 ValidSize; 
  unsigned int v37; 
  int v38; 
  _WNODE_HEADER *v39; 
  unsigned int v40; 
  int v41; 
  unsigned int v42; 
  unsigned int v43; 
  VOID *Src; 
  __int64 v45; 
  _WMIGUIDOBJECT **v46; 
  UINT8 *v47; 
  unsigned int v48; 
  _UNICODE_STRING v49; 
  VOID *v50; 
  _WMIGUIDOBJECT *GuidObject; 
  PVOID v52; 
  PVOID v53; 
  UINT64 *v54; 
  _UNICODE_STRING *v55; 
  _IRP *Irpa; 
  UINT8 *v57; 
  UINT64 *v58; 
  char P[592]; 

  v37 = BufferSize;
  v9 = BufferPtr;
  v47 = BufferPtr;
  Irpa = Irp;
  v54 = ReturnSize;
  v58 = ReturnSize;
  v57 = BufferPtr;
  v48 = QueryCount;
  v46 = ObjectList;
  v55 = InstanceNames;
  LODWORD(ValidSize) = 0;
  v41 = 0;
  v49 = 0i64;
  memset(P, 0i64, 0x248u);
  v10 = 0;
  v38 = 0;
  v11 = ObjectList;
  if( ObjectList )
  {
    v13 = 0i64;
    v52 = 0i64;
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 24i64 * (unsigned int)QueryCount, 1885957463i64);
    v13 = PoolWithTag;
    v52 = PoolWithTag;
    if( PoolWithTag )
      memmove(PoolWithTag, QsiMultiple + 2, 24 * QueryCount);
    else
      v10 = -1073741670;
    v9 = v47;
    v11 = v46;
  }
  if( v10 < 0 )
    return v10;
  v14 = 0;
  HIDWORD(ValidSize) = 0;
  v15 = 0;
  v33 = 0;
  v45 = 0i64;
  v16 = (_WNODE_HEADER *)v9;
  v39 = (_WNODE_HEADER *)v9;
  v17 = (VOID **)P;
  v53 = P;
  v18 = 580;
  v43 = 580;
  v19 = 0;
  GuidObject = 0i64;
  while( 1 )
  {
    v42 = v19;
    if( v19 >= v48 )
      break;
    if( v11 )
    {
      v49 = v55[v19];
      GuidObject = v11[v19];
      v50 = 0i64;
      Src = v49.Buffer;
      Length = v49.Length;
    }
    else
    {
      Length = (unsigned __int16)v13[3 * v19 + 1];
      *(_DWORD *)&v49.Length = v13[3 * v19 + 1];
      Src = v13[3 * v19 + 2];
      v49.Buffer = (wchar_t *)Src;
      v50 = v13[3 * v19];
      v16 = v39;
    }
    v35 = Length;
    v21 = (Length + 73) & 0xFFFFFFF8;
    if( v15 || v37 < v21 )
    {
      if( v21 > v18 )
      {
        if( v17 != (VOID **)P )
          ExFreePoolWithTag(v17, 0);
        v17 = ExAllocatePoolWithTag(0x200ui64, v21, 1885957463i64);
        v53 = v17;
        if( !v17 )
        {
          v10 = -1073741670;
          break;
        }
        v43 = v21;
      }
      Wnode = v17;
      v40 = v21;
      v45 = 0i64;
      v33 = 1;
    }
    else
    {
      Wnode = &v16->BufferSize;
      v40 = v37;
    }
    memset(Wnode, 0i64, 0x40u);
    Wnode[11] = 2;
    *Wnode = v21;
    *((_QWORD *)Wnode + 2) = v50;
    Wnode[12] = 64;
    Wnode[14] = v21;
    *((_WORD *)Wnode + 32) = v35;
    if( AccessMode == 1 && v35 )
    {
      if( ((__int64)v49.Buffer & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      v23 = Src;
      if( (unsigned __int64)Src + v35 > 0x7FFFFFFF0000i64 || (char *)Src + v35 < Src )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    else
    {
      v23 = Src;
    }
    memmove((char *)Wnode + 66, v23, v35);
    LODWORD(ValidSize) = *Wnode;
    LODWORD(OutBufferSize) = v40;
    LOBYTE(v24) = AccessMode;
    if( WmipQuerySetExecuteSI(GuidObject, Irpa, v24, 1u, Wnode, OutBufferSize, &ValidSize) < 0 )
      goto LABEL_37;
    v25 = Wnode[11];
    if( (v25 & 0x100) != 0 )
      goto LABEL_37;
    ++v38;
    if( (v25 & 0x20) != 0 )
    {
      v14 += (Wnode[12] + 7) & 0xFFFFFFF8;
      HIDWORD(ValidSize) = v14;
      v15 = 1;
      v33 = 1;
      goto LABEL_38;
    }
    if( v33 )
    {
      v14 += (ValidSize + 7) & 0xFFFFFFF8;
      HIDWORD(ValidSize) = v14;
LABEL_37:
      v15 = v33;
LABEL_38:
      v16 = v39;
      goto LABEL_39;
    }
    if( v45 )
      *(_DWORD *)(v45 + 12) = v41;
    for( i = (__int64)Wnode; ; i += v27 )
    {
      v45 = i;
      v27 = *(unsigned int *)(i + 12);
      if( !(_DWORD)v27 )
        break;
    }
    v28 = ((_DWORD)ValidSize + 7) & 0xFFFFFFF8;
    v14 += v28;
    HIDWORD(ValidSize) = v14;
    v37 -= v28;
    v16 = (_WNODE_HEADER *)((char *)v39 + v28);
    v39 = v16;
    v41 = (_DWORD)v16 - i;
    v15 = 0;
LABEL_39:
    v19 = v42 + 1;
    v18 = v43;
    v11 = v46;
  }
  v29 = v47;
  if( v17 != (VOID **)P )
    ExFreePoolWithTag(v17, 0);
  if( !v38 )
    v10 = -1073741163;
  if( v10 >= 0 && v15 )
  {
    v30 = 56;
    *(_DWORD *)v29 = 56;
    *((_DWORD *)v29 + 11) = 32;
    *((_DWORD *)v29 + 12) = v14;
  }
  else
  {
    v30 = v14;
  }
  *(_DWORD *)v54 = v30;
  if( v13 )
    ExFreePoolWithTag(v13, 0);
  return v10;
}

Referenced by: