SbpAddTransportToInstance

INT64 __fastcall SbpAddTransportToInstance(){
  char *v0; 
  NTSTATUS DeviceObjectPointer; 
  PFILE_OBJECT v2; 
  unsigned int Status; 
  char *PoolWithTag; 
  _DEVICE_OBJECT *v5; 
  _IRP *v6; 
  IRP *v7; 
  __int64 v8; 
  _DEVICE_OBJECT *v9; 
  UINT64 OutputBufferLength; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _KEVENT Object; 
  PVOID ReturnAddress; 
  PDEVICE_OBJECT DeviceObject; 
  PFILE_OBJECT FileObject; 
  FileObject = 0i64;
  DeviceObject = 0i64;
  memset(&Object, 0, sizeof(Object));
  v0 = 0i64;
  IoStatusBlock = 0i64;
  DeviceObjectPointer = IoGetDeviceObjectPointer(
                          (UNICODE_STRING *)InstanceName,
                          0x10000000ui64,
                          &FileObject,
                          &DeviceObject);
  v2 = FileObject;
  Status = DeviceObjectPointer;
  if( DeviceObjectPointer >= 0 )
  {
    PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0xD0ui64, 0x42626D53ui64);
    v0 = PoolWithTag;
    if( !PoolWithTag )
      goto LABEL_3;
    memset((INT64)(PoolWithTag + 12), 0i64);
    *(_DWORD *)v0 = 16;
    *((_DWORD *)v0 + 1) = 2;
    *((_DWORD *)v0 + 2) = 192;
    *(_OWORD *)(v0 + 12) = *(_OWORD *)L"\\Device\\VMBus\\{4d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3"
                                       "493609c0870}-0000";
    *(_OWORD *)(v0 + 28) = *(_OWORD *)L"VMBus\\{4d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 44) = *(_OWORD *)L"d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 60) = *(_OWORD *)L"17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 76) = *(_OWORD *)L"4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 92) = *(_OWORD *)L"270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 108) = *(_OWORD *)L"db7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    v5 = DeviceObject;
    *(_OWORD *)(v0 + 124) = *(_OWORD *)L"c079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 140) = *(_OWORD *)L"0ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 156) = *(_OWORD *)L"-847c-3493609c0870}-0000";
    *(_OWORD *)(v0 + 172) = *(_OWORD *)L"93609c0870}-0000";
    *(_OWORD *)(v0 + 188) = *(_OWORD *)L"70}-0000";
    Object.Header.WaitListHead.Blink = &Object.Header.WaitListHead;
    LOWORD(Object.Header.Lock) = 1;
    Object.Header.WaitListHead.Flink = &Object.Header.WaitListHead;
    LODWORD(OutputBufferLength) = 0;
    Object.Header.Size = 6;
    Object.Header.SignalState = 0;
    v6 = IopBuildDeviceIoControlRequest(
           0x1401B0ui64,
           v5,
           v0,
           0xD0ui64,
           0i64,
           OutputBufferLength,
           0,
           &Object,
           &IoStatusBlock,
           ReturnAddress);
    v7 = v6;
    if( v6 )
    {
      v8 = *((_QWORD *)v6 + 23);
      v9 = DeviceObject;
      *(_QWORD *)(v8 - 24) = v2;
      *(_BYTE *)(v8 - 72) = 13;
      Status = IofCallDriver(v9, v7);
      if( Status == 259 )
      {
        KeWaitForSingleObject(&Object, Executive, 0, 0, 0i64);
        Status = IoStatusBlock.Status;
      }
    }
    else
    {
LABEL_3:
      Status = -1073741670;
    }
  }
  if( v2 )
    ObfDereferenceObjectWithTag(v2, 0x746C6644ui64);
  if( v0 )
    ExFreeHeapPool(v0);
  return Status;
}

Referenced by: