PiDrvDbCreateNode

NTSTATUS __stdcall PiDrvDbCreateNode(WCHAR *Name, UINT64 Flags, PI_DRVDB_NODE **pDrvDbNode){
  INT8 *v3; 
  int v4; 
  INT8 *v6; 
  VOID **PoolWithTag; 
  __int64 v8; 
  _WORD *v9; 
  __int64 v10; 
  VOID *StringRoutine; 
  int appended; 
  __int64 v13; 
  VOID *v14; 
  int v15; 
  __int64 *v16; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Handle; 
  PI_DRVDB_NODE **pDrvDbNodea; 

  v4 = Flags;
  Handle = 0i64;
  v6 = v3;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x208ui64, 1650749520i64);
  v8 = (__int64)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, 0x208u);
  v9 = (_WORD *)(v8 + 16);
  *(_DWORD *)(v8 + 64) = v4;
  if( !RtlCreateUnicodeString(v8 + 16, (INT8 *)Name) )
    goto LABEL_22;
  v10 = (unsigned __int16)(*v9 + 38);
  *(_WORD *)(v8 + 32) = 0;
  *(_WORD *)(v8 + 34) = v10;
  StringRoutine = ExpAllocateStringRoutine((unsigned __int16)v10);
  *(_QWORD *)(v8 + 40) = StringRoutine;
  if( !StringRoutine )
    goto LABEL_22;
  appended = RtlAppendUnicodeToString((_UNICODE_STRING *)(v8 + 32), (WCHAR *)L"\\REGISTRY\\MACHINE\\");
  if( appended < 0 )
    goto LABEL_17;
  appended = RtlAppendUnicodeToString((_UNICODE_STRING *)(v8 + 32), Name);
  if( appended < 0 )
    goto LABEL_17;
  if( !v6 )
  {
    v13 = (unsigned __int16)(*v9 + 58);
    *(_WORD *)(v8 + 48) = 0;
    *(_WORD *)(v8 + 50) = v13;
    v14 = ExpAllocateStringRoutine((unsigned __int16)v13);
    *(_QWORD *)(v8 + 56) = v14;
    if( v14 )
    {
      appended = RtlAppendUnicodeToString((_UNICODE_STRING *)(v8 + 48), (WCHAR *)L"\\SystemRoot\\System32\\config\\");
      if( appended < 0 )
        goto LABEL_17;
      appended = RtlAppendUnicodeToString((_UNICODE_STRING *)(v8 + 48), Name);
      if( appended < 0 )
        goto LABEL_17;
      goto LABEL_10;
    }
LABEL_22:
    appended = -1073741670;
    goto LABEL_17;
  }
  if( !RtlCreateUnicodeString(v8 + 48, v6) )
    goto LABEL_22;
LABEL_10:
  v15 = *(_DWORD *)(v8 + 64);
  if( (v15 & 4) == 0 )
  {
LABEL_14:
    if( (v15 & 0x10) == 0
      || (appended = SysCtxRegOpenKey(0i64, 0i64, *(const WCHAR **)(v8 + 40), 0, 0x2000000u, &Handle), appended >= 0)
      && (appended = SysCtxRegOpenKey(0i64, Handle, L"DriverDatabase", 0, 0x2000000u, (VOID **)(v8 + 72)),
          ZwClose((_HANDLE)Handle),
          appended >= 0) )
    {
      *(_DWORD *)(v8 + 496) = 259;
      v16 = (__int64 *)qword_140C42E98;
      if( *(INT64 **)qword_140C42E98 != &PiDrvDbNodeList )
        __fastfail(3u);
      *(_QWORD *)(v8 + 8) = qword_140C42E98;
      *(_QWORD *)v8 = &PiDrvDbNodeList;
      *v16 = v8;
      qword_140C42E98 = v8;
      *pDrvDbNodea = (PI_DRVDB_NODE *)v8;
      v8 = 0i64;
    }
    goto LABEL_17;
  }
  appended = ExInitializeResourceLite(v8 + 88);
  if( appended >= 0 )
  {
    *(_BYTE *)(v8 + 192) = 1;
    KeInitializeTimerEx(v8 + 264, 0);
    KeInitializeDpc((PRKDPC)(v8 + 328), PiDrvDbUnloadNodeDpcRoutine, (PVOID)v8);
    *(_QWORD *)(v8 + 424) = 0i64;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 512;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    appended = ZwCreateEvent(v8 + 472, 0x1F0003ui64, (INT64)&ObjectAttributes, 0i64, 1u);
    if( appended >= 0 )
    {
      *(_BYTE *)(v8 + 489) = 1;
      *(_QWORD *)(v8 + 480) = 0xFFFFFFFFi64;
      v15 = *(_DWORD *)(v8 + 64);
      goto LABEL_14;
    }
  }
LABEL_17:
  if( v8 )
    PiDrvDbDestroyNode((VOID *)v8);
  return appended;
}

Referenced by: