PipApplyFunctionToServiceInstances

NTSTATUS __stdcall PipApplyFunctionToServiceInstances(_UNICODE_STRING *ServiceKeyName, VOID *Context){
  char v2; 
  NTSTATUS result; 
  int v4; 
  NTSTATUS RegistryValue; 
  int v6; 
  VOID **PoolWithTag; 
  unsigned int i; 
  NTSTATUS v9; 
  unsigned int v10; 
  _WORD *v11; 
  int v12; 
  UINT64 Length; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  _UNICODE_STRING DeviceInstancePath; 
  VOID *ServiceEnumHandle; 
  UINT64 ResultLength; 
  int v18; 
  WCHAR *DeviceInstanceId; 
  VOID *Contexta; 
  VOID *DeviceInstanceHandle; 

  LOBYTE(v18) = v2;
  ServiceEnumHandle = 0i64;
  LODWORD(ResultLength) = 0;
  Information = 0i64;
  DeviceInstanceId = 0i64;
  DeviceInstancePath = 0i64;
  result = PipOpenServiceEnumKeys((_UNICODE_STRING *)Context, 0x20019ui64, 0i64, &ServiceEnumHandle, 0);
  if( result < 0 )
    return result;
  v4 = 0;
  RegistryValue = IopGetRegistryValue(ServiceEnumHandle, (PWCHAR)&stru_1407D01E0._Xmm8, 0i64, &Information);
  v6 = RegistryValue;
  if( RegistryValue < 0 )
  {
    if( RegistryValue != -1073741772 )
      goto LABEL_21;
    v6 = 0;
  }
  else
  {
    if( Information->Type == 4 && Information->DataLength >= 4 )
      v4 = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset);
    ExFreePoolWithTag(Information, 0);
  }
  if( !v4 )
    goto LABEL_21;
  DeviceInstanceHandle = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x200ui64, 538996816i64);
  if( !PoolWithTag )
  {
    v6 = -1073741670;
    goto LABEL_21;
  }
  for( i = 0; ; ++i )
  {
    LODWORD(Length) = 512;
    v9 = ZwEnumerateValueKey(ServiceEnumHandle, i, KeyValueFullInformation, PoolWithTag, Length, &ResultLength);
    if( v9 < 0 )
      break;
    if( *((_DWORD *)PoolWithTag + 1) == 1 )
    {
      DeviceInstancePath.Length = 0;
      v10 = *((_DWORD *)PoolWithTag + 3);
      v11 = (_WORD *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
      v18 = 0;
      PnpRegSzToString(v11, v10, &v18);
      DeviceInstancePath.Length = v18;
      DeviceInstancePath.MaximumLength = *((_WORD *)PoolWithTag + 6);
      DeviceInstancePath.Buffer = (wchar_t *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
      if( (_WORD)v18 )
      {
        if( (int)PnpUnicodeStringToWstr((__int16 **)&DeviceInstanceId, 0i64, &DeviceInstancePath.Length) >= 0 )
        {
          LODWORD(Length) = 983103;
          v6 = CmOpenDeviceRegKey(
                 *(&stru_140CF2E80 + 607),
                 DeviceInstanceId,
                 CM_KEY_TYPE_DEVICE_INSTANCE,
                 0i64,
                 Length,
                 0,
                 &DeviceInstanceHandle,
                 0i64);
          PnpUnicodeStringToWstrFree(DeviceInstanceId, (__int64)&DeviceInstancePath);
          if( v6 >= 0 )
          {
            v12 = PipAddDevicesToBootDriverWorker(DeviceInstanceHandle, &DeviceInstancePath, Contexta);
            ZwClose((_HANDLE)DeviceInstanceHandle);
            if( !v12 )
              goto LABEL_20;
          }
        }
      }
    }
LABEL_12:
    ;
  }
  if( v9 != -2147483622 )
    goto LABEL_12;
  v6 = 0;
LABEL_20:
  ExFreePoolWithTag(PoolWithTag, 0);
LABEL_21:
  ZwClose((_HANDLE)ServiceEnumHandle);
  return v6;
}

Referenced by: