WmipPrepareWnodeSI

INT64 __fastcall WmipPrepareWnodeSI(INT64 a1, INT64 a2, UINT64 *a3, VOID **a4, BYTE *a5, BYTE *a6){
  void *v7; 
  __int64 v8; 
  void *v9; 
  __int64 v10; 
  int v11; 
  wchar_t *v12; 
  __int64 v13; 
  UINT64 v14; 
  int v15; 
  _DWORD *v17; 
  size_t v18; 
  unsigned int v19; 
  const wchar_t *v20; 
  unsigned __int64 v21; 
  wchar_t *v22; 
  unsigned int v23; 
  BYTE *v24; 
  unsigned int v25; 
  __int64 v26; 
  BYTE *v27; 
  volatile signed __int64 **v28; 
  wchar_t *Str1; 
  unsigned int v30; 
  void *v31; 
  unsigned int v32; 
  void *v33; 
  BYTE *v34; 
  UINT64 *v35; 
  VOID **v36; 
  __int64 v37; 
  wchar_t pszDest[8]; 
  v35 = a3;
  v36 = a4;
  v7 = 0i64;
  v8 = 0i64;
  v9 = 0i64;
  v34 = a5;
  v31 = 0i64;
  *a5 = 1;
  v10 = *(_QWORD *)(a1 + 56);
  v30 = 0;
  if( v10 && *(_DWORD *)(v10 + 36) )
  {
    v11 = 0;
    *(_OWORD *)(a2 + 24) = *(_OWORD *)(v10 + 72);
    if( (*(_DWORD *)(v10 + 16) & 1) != 0 )
    {
      *a6 = 1;
    }
    else
    {
      *a6 = 0;
      Str1 = WmipCountedToSz((WCHAR *)(a2 + *(unsigned int *)(a2 + 48)));
      v12 = Str1;
      if( Str1 )
      {
        v31 = *v36;
        v7 = v31;
        v33 = v31;
        v32 = *(_DWORD *)v35;
        KeWaitForSingleObject(&WmipSMMutex, Executive, 0, 0, 0i64);
        if( *(_DWORD *)(v10 + 36) )
        {
          v13 = v10 + 56;
          v14 = *(_QWORD *)(v10 + 56);
          v37 = v13;
          if( v14 != v13 )
          {
            do
            {
              if( (_BYTE)v9 )
                break;
              v15 = *(_DWORD *)(v14 + 16);
              if( (v15 & 0x89000) == 0 )
              {
                if( (v15 & 1) != 0 )
                {
                  v17 = *(_DWORD **)(v14 + 88);
                  v18 = -1i64;
                  v19 = *v17;
                  v20 = (const wchar_t *)(v17 + 1);
                  do
                    ++v18;
                  while( v20[v18] );
                  v21 = -1i64;
                  do
                    ++v21;
                  while( Str1[v21] );
                  if( v21 <= v18 || wcsnicmp(Str1, v20, v18) )
                  {
                    v12 = Str1;
                  }
                  else
                  {
                    v22 = &Str1[v18];
                    v23 = wtoi(v22);
                    if( WmipIsNumber(v22) )
                    {
                      if( v23 >= v19 && v23 < v19 + *(_DWORD *)(v14 + 72) && v23 < 0xF423F )
                      {
                        RtlStringCbPrintfW(pszDest, 0xEui64, (WCHAR *)L"%d");
                        if( !wcsicmp(pszDest, v22) )
                        {
                          *(_DWORD *)(a2 + 44) |= 0x80u;
                          LOBYTE(v9) = 1;
                          *(_DWORD *)(a2 + 4) = *(_DWORD *)(v14 + 80);
                          v24 = v34;
                          *(_DWORD *)(a2 + 52) = v23 - v19;
                          *v24 = 0;
                        }
                      }
                    }
                    v12 = Str1;
                  }
                }
                else if( (v15 & 2) != 0 )
                {
                  v25 = 0;
                  v26 = *(_QWORD *)(v14 + 88);
                  if( *(_DWORD *)(v14 + 72) )
                  {
                    while( wcsicmp(*(const wchar_t **)(v26 + 8i64 * v25), v12) )
                    {
                      if( ++v25 >= *(_DWORD *)(v14 + 72) )
                        goto LABEL_13;
                    }
                    *(_DWORD *)(a2 + 44) |= 0x80u;
                    LOBYTE(v9) = 1;
                    *(_DWORD *)(a2 + 4) = *(_DWORD *)(v14 + 80);
                    v27 = v34;
                    *(_DWORD *)(a2 + 52) = v25;
                    *v27 = 0;
                  }
                }
                else
                {
                  WmipReferenceEntry(v14);
                  v11 = WmipAddProviderIdToPIList((const void **)&v33, &v30, &v32, v31, (volatile signed __int64 *)v14);
                  if( v11 < 0 )
                    LOBYTE(v9) = 1;
                }
              }
LABEL_13:
              v14 = *(_QWORD *)v14;
            }
            while( v14 != v37 );
            v7 = v33;
            v8 = v30;
          }
        }
        else
        {
          v11 = -1073741055;
        }
        ExFreePoolWithTag(v12, 0);
        KeReleaseMutex(&WmipSMMutex, 0);
        v9 = v31;
      }
      else
      {
        v11 = -1073741670;
      }
      if( *v34 )
      {
        *(_DWORD *)v35 = v8;
        *v36 = v7;
      }
      else if( v7 )
      {
        if( (_DWORD)v8 )
        {
          v28 = (volatile signed __int64 **)v7;
          do
          {
            WmipUnreferenceEntry((__int64)&WmipISChunkInfo, *v28++);
            --v8;
          }
          while( v8 );
          v9 = v31;
        }
        if( v7 != v9 )
          ExFreePoolWithTag(v7, 0);
      }
    }
  }
  else
  {
    return(unsigned int)-1073741055;
  }
  return(unsigned int)v11;
}

Referenced by:

WmipQuerySetExecuteSI