PnpCtxCreateNode

__int64 __fastcall PnpCtxCreateNode(
        _DWORD *a1,
        WCHAR *a2,
        int a3,
        __int64 a4,
        VOID *SystemKey,
        PVOID P,
        VOID *UsersKey,
        VOID *TransactionHandle,
        _QWORD *a9){
  _QWORD *v9; 
  PVOID v10; 
  VOID **PoolWithTag; 
  VOID **v15; 
  UINT64 v16; 
  VOID *v17; 
  VOID *v18; 
  NTSTATUS v19; 
  unsigned int v20; 
  int v21; 
  int v23; 
  UINT64 Version; 

  v9 = a9;
  v10 = 0i64;
  P = 0i64;
  *a9 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x98ui64, 1380994640i64);
  v15 = PoolWithTag;
  if( !PoolWithTag )
    return(unsigned int)-1073741801;
  memset(PoolWithTag, 0i64, 0x98u);
  if( RtlCreateUnicodeString((INT64)(v15 + 4), (INT8 *)a2) )
  {
    v18 = UsersKey;
    *((_DWORD *)v15 + 12) = a3;
    LODWORD(Version) = *a1;
    v19 = SysCtxOpenMachine(v16, SystemKey, v17, v18, TransactionHandle, Version, (HSYSCTX **)&P);
    v10 = P;
    v20 = v19;
    if( v19 >= 0 )
    {
      if( *(_DWORD *)P < 0xA000000u )
      {
        v20 = -1073741637;
      }
      else
      {
        v15[8] = 0i64;
        v15[9] = 0i64;
        v15[10] = 0i64;
        v15[11] = 0i64;
        v15[12] = 0i64;
        v15[13] = 0i64;
        v15[14] = 0i64;
        v15[16] = 0i64;
        v15[17] = 0i64;
        v15[18] = 0i64;
        v21 = a3 - 1;
        if( v21 )
        {
          v23 = v21 - 1;
          if( v23 )
          {
            if( v23 != 1 )
            {
              v20 = -1073741811;
              goto LABEL_7;
            }
            v15[8] = (VOID *)-1i64;
            v15[12] = (VOID *)-1i64;
            v15[13] = (VOID *)-1i64;
            v15[14] = (VOID *)-1i64;
            v15[16] = (VOID *)-1i64;
            v15[17] = (VOID *)-1i64;
            v15[18] = (VOID *)-1i64;
          }
        }
        v15[7] = v10;
        v10 = 0i64;
        *v9 = v15;
        v15 = 0i64;
      }
    }
  }
  else
  {
    v20 = -1073741801;
  }
LABEL_7:
  if( v15 )
    ExFreePoolWithTag(v15, 0);
  if( v10 )
    SysCtxCloseMachine(v10);
  return v20;
}

Referenced by: