PipCreateComputerId
NTSTATUS __stdcall PipCreateComputerId(
VOID *ComputerIdsKeyHandle,
_UNICODE_STRING **StringList,
UINT64 StringCount,
_LPGUID ComputerId){
unsigned int v4;
unsigned __int16 v8;
unsigned int v9;
_WORD **v10;
_WORD *v11;
unsigned __int16 v12;
unsigned __int16 v13;
VOID **PoolWithTag;
VOID **v15;
_WORD *v16;
int v17;
int Class5Guid;
UINT64 v19;
VOID *Data;
UINT64 DataSize;
UINT64 DataSizea;
_UNICODE_STRING DestinationString;
VOID *KeyHandle;
WCHAR GuidString[40];
WCHAR pszDest[48];
_GUID *Guid;
v4 = 0;
KeyHandle = ComputerIdsKeyHandle;
v8 = 0;
v9 = 0;
DestinationString = 0i64;
if( !ComputerId )
return -1073741811;
v10 = (_WORD **)StringCount;
do
{
v11 = *v10;
v12 = v8 + 2;
++v10;
if( !v9 )
v12 = v8;
++v9;
v8 = *v11 + v12;
}
while( v9 < ComputerId );
if( v8 <= 2u )
return -1073741811;
v13 = v8 + 2;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v13, 1852403792i64);
v15 = PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v16 = PoolWithTag;
do
{
if( v4 )
*v16++ = 38;
if( **(_WORD **)StringCount )
{
memmove(v16, *(const VOID **)(*(_QWORD *)StringCount + 8i64), **(unsigned __int16 **)StringCount);
v16 += (unsigned __int64)**(unsigned __int16 **)StringCount >> 1;
}
++v4;
StringCount += 8i64;
}
while( v4 < ComputerId );
*v16 = 0;
v17 = v13;
Class5Guid = RtlGenerateClass5Guid(&NamespaceGuid, v15, (unsigned int)v13 - 2, Guid);
if( Class5Guid >= 0 )
{
Class5Guid = PnpStringFromGuid(Guid, GuidString, v19);
if( Class5Guid >= 0 )
{
RtlInitUnicodeString(&DestinationString, GuidString);
LODWORD(DataSize) = v17;
Class5Guid = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 1ui64, v15, DataSize);
if( Class5Guid >= 0 )
{
if( StringList )
{
LODWORD(Data) = 2048;
Class5Guid = RtlStringCbPrintfExW(pszDest, 0x5Cui64, 0i64, 0i64, (UINT64)Data, (WCHAR *)L"%ws_%ws");
if( Class5Guid >= 0 )
{
RtlInitUnicodeString(&DestinationString, pszDest);
LODWORD(DataSizea) = 0;
Class5Guid = ZwSetValueKey(StringList, &DestinationString, 0i64, 1ui64, 0i64, DataSizea);
}
}
}
}
}
ExFreePoolWithTag(v15, 0);
return Class5Guid;
}Referenced by:
PipInitComputerIds