ViDdiDispatchWmiQueryAllData

NTSTATUS __stdcall ViDdiDispatchWmiQueryAllData(_DEVICE_OBJECT *DeviceObject, _IRP *Irp){
  _IO_STACK_LOCATION *CurrentStackLocation; 
  NTSTATUS result; 
  unsigned int v6; 
  unsigned int *DeviceExtension; 
  __int64 v8; 
  int v9; 
  unsigned int v10; 
  int v11; 
  NTSTATUS v12; 
  unsigned int v13; 
  UINT64 TotalRequiredSize; 
  UINT64 InstanceCount; 
  UINT64 DataBlockOffset; 
  UINT64 OffsetInstanceNameOffsets; 

  CurrentStackLocation = Irp->Tail.CurrentStackLocation;
  LODWORD(OffsetInstanceNameOffsets) = 0;
  LODWORD(InstanceCount) = 0;
  LODWORD(DataBlockOffset) = 0;
  LODWORD(TotalRequiredSize) = 0;
  if( (_DEVICE_OBJECT *)CurrentStackLocation->Parameters.SecurityContext != DeviceObject )
    return -1073741637;
  if( RtlCompareMemory(*(const VOID **)&CurrentStackLocation->Parameters.Options, &GUID_VERIFIER_WMI_INTERFACE, 16) != (_SIZE_T *)16 )
    return -1073741163;
  v6 = *(_DWORD *)&CurrentStackLocation->Parameters.FileAttributes;
  DeviceExtension = (unsigned int *)DeviceObject->DeviceExtension;
  if( v6 < 0x38 )
    return -1073741789;
  v8 = *(_QWORD *)&CurrentStackLocation->Parameters.EaLength;
  *(_QWORD *)(v8 + 16) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
  result = VfIrpLogLockDatabase(*DeviceExtension);
  if( result >= 0 )
  {
    v9 = VfIrpLogRetrieveWmiData(
           *DeviceExtension,
           0i64,
           &OffsetInstanceNameOffsets,
           &InstanceCount,
           &DataBlockOffset,
           &TotalRequiredSize);
    if( v9 < 0 )
    {
      VfIrpLogUnlockDatabase(*DeviceExtension);
      return v9;
    }
    v10 = TotalRequiredSize + 72;
    LODWORD(TotalRequiredSize) = v10;
    if( v10 <= v6 )
    {
      v11 = InstanceCount;
      if( (_DWORD)InstanceCount )
      {
        v12 = VfIrpLogRetrieveWmiData(
                *DeviceExtension,
                (UINT8 *)v8,
                &OffsetInstanceNameOffsets,
                &InstanceCount,
                &DataBlockOffset,
                &TotalRequiredSize);
        v11 = InstanceCount;
        v9 = v12;
        v10 = TotalRequiredSize;
      }
      VfIrpLogUnlockDatabase(*DeviceExtension);
      if( v9 < 0 )
        return v9;
      if( v11 )
      {
        *(_DWORD *)v8 = 72;
        v10 = 72;
        *(_DWORD *)(v8 + 60) = 0;
        *(_DWORD *)(v8 + 48) = 0;
        *(_DWORD *)(v8 + 56) = 0;
      }
      else
      {
        v13 = *(_DWORD *)(v8 + 44) & 0xFFFFFFEF;
        *(_DWORD *)v8 = v10;
        *(_DWORD *)(v8 + 44) = v13 | 1;
        *(_DWORD *)(v8 + 48) = DataBlockOffset;
        *(_DWORD *)(v8 + 56) = OffsetInstanceNameOffsets;
      }
      *(_DWORD *)(v8 + 52) = 0;
      Irp->IoStatus.Information = v10;
    }
    else
    {
      VfIrpLogUnlockDatabase(*DeviceExtension);
      *(_DWORD *)(v8 + 44) |= 0x20u;
      *(_DWORD *)(v8 + 48) = v10;
      Irp->IoStatus.Information = 56i64;
    }
    return 0;
  }
  return result;
}

Referenced by: