PipApplyFunctionToServiceInstances

INT64 __stdcall PipApplyFunctionToServiceInstances(UNICODE_STRING *ServiceKeyName, PVOID Context){
  char v2; 
  INT64 result; 
  int v4; 
  NTSTATUS RegistryValue; 
  int v6; 
  unsigned __int16 *PoolWithTag; 
  unsigned int i; 
  NTSTATUS v9; 
  UINT64 v10; 
  WCHAR *v11; 
  int v12; 
  UINT64 Length; 
  PVOID P; 
  UNICODE_STRING InUnicodeString; 
  HANDLE KeyHandle; 
  UINT64 ResultLength; 
  UINT64 StringLength; 
  WCHAR *OutString; 
  VOID *Contexta; 
  HANDLE Handle; 
  LOBYTE(StringLength) = v2;
  KeyHandle = 0i64;
  LODWORD(ResultLength) = 0;
  P = 0i64;
  OutString = 0i64;
  InUnicodeString = 0i64;
  LODWORD(result) = PipOpenServiceEnumKeys((UNICODE_STRING *)Context, 0x20019ui64, 0i64, &KeyHandle, 0);
  if( (int)result < 0 )
    return result;
  v4 = 0;
  RegistryValue = IopGetRegistryValue(KeyHandle, (PWCHAR)&stru_1407D01E0.Xmm8, 0i64, (KEY_VALUE_FULL_INFORMATION **)&P);
  v6 = RegistryValue;
  if( RegistryValue < 0 )
  {
    if( RegistryValue != -1073741772 )
      goto LABEL_21;
    v6 = 0;
  }
  else
  {
    if( *((_DWORD *)P + 1) == 4 && *((_DWORD *)P + 3) >= 4u )
      v4 = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
    ExFreePoolWithTag(P, 0);
  }
  if( !v4 )
    goto LABEL_21;
  Handle = 0i64;
  PoolWithTag = (unsigned __int16 *)ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x20207050ui64);
  if( !PoolWithTag )
  {
    v6 = -1073741670;
    goto LABEL_21;
  }
  for( i = 0; ; ++i )
  {
    LODWORD(Length) = 512;
    v9 = ZwEnumerateValueKey(KeyHandle, i, KeyValueFullInformation, PoolWithTag, Length, &ResultLength);
    if( v9 < 0 )
      break;
    if( *((_DWORD *)PoolWithTag + 1) == 1 )
    {
      InUnicodeString.Length = 0;
      v10 = *((unsigned int *)PoolWithTag + 3);
      v11 = (unsigned __int16 *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
      LODWORD(StringLength) = 0;
      PnpRegSzToString(v11, v10, &StringLength);
      InUnicodeString.Length = StringLength;
      InUnicodeString.MaximumLength = PoolWithTag[6];
      InUnicodeString.Buffer = (unsigned __int16 *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
      if( (_WORD)StringLength )
      {
        if( (int)PnpUnicodeStringToWstr(&OutString, 0i64, &InUnicodeString) >= 0 )
        {
          v6 = CmOpenDeviceRegKey(PiPnpRtlCtx, OutString, 16, 0, 983103, 0, (__int64)&Handle, 0i64);
          PnpUnicodeStringToWstrFree(OutString, &InUnicodeString);
          if( v6 >= 0 )
          {
            v12 = PipAddDevicesToBootDriverWorker(Handle, &InUnicodeString, Contexta);
            ZwClose(Handle);
            if( !v12 )
              goto LABEL_20;
          }
        }
      }
    }
LABEL_12:
    ;
  }
  if( v9 != -2147483622 )
    goto LABEL_12;
  v6 = 0;
LABEL_20:
  ExFreePoolWithTag(PoolWithTag, 0);
LABEL_21:
  ZwClose(KeyHandle);
  return(unsigned int)v6;
}

Referenced by: