PiDrvDbOverlayCopyKeys
INT64 __fastcall PiDrvDbOverlayCopyKeys(
VOID *a1,
const WCHAR *a2,
VOID *a3,
const WCHAR *a4,
INT64 a5,
const WCHAR **a6,
UINT64 a7,
VOID *a8){
ULONG v10;
char *PoolWithTag;
void *v12;
int v13;
int v14;
__int64 v15;
ULONG v16;
unsigned int v17;
unsigned int v18;
unsigned int i;
int v20;
__int64 v21;
unsigned int v22;
__int64 v23;
unsigned int v24;
const wchar_t **v25;
__int64 v26;
__int16 v27;
unsigned int v28;
VOID *v29;
int v30;
ULONG v31;
int v32;
UINT64 v33;
PULONG ResultLength;
UINT64 v36;
unsigned int v37;
ULONG NumberOfBytes;
unsigned int NumberOfBytes_4;
unsigned int v40;
unsigned int v41;
ULONG v42;
HANDLE KeyHandle;
HANDLE Handle;
unsigned int v45;
int v46;
ULONG v47;
ULONG v48;
HANDLE v49;
PVOID P;
const WCHAR **v51;
char *v52;
__int64 KeyInformation;
int v54;
v51 = a6;
v10 = 0;
v52 = (char *)a8;
PoolWithTag = 0i64;
KeyHandle = 0i64;
KeyInformation = 0i64;
v54 = 0;
v12 = 0i64;
v49 = 0i64;
P = 0i64;
Handle = 0i64;
v46 = 0;
v47 = 0;
v37 = 0;
v40 = 0;
v41 = 0;
NumberOfBytes = 0;
v48 = 0;
v42 = 0;
v45 = a7;
v13 = SysCtxRegOpenKey(0i64, (char *)a1, a2, 8u, 0x20019u, &KeyHandle);
if( v13 >= 0 )
{
if( ZwQueryKey(KeyHandle, KeyFlagsInformation, &KeyInformation, 0xCui64, (UINT64 *)&v42) >= 0 )
{
if( (KeyInformation & 0x200000000i64) != 0 )
{
v13 = -2147483603;
goto LABEL_85;
}
if( (KeyInformation & 0x100000000i64) != 0 )
v10 = 1;
}
v14 = PnpCtxRegCreateKey(0i64, (__int64)a3, a4, v10, 0x6001Fu, 0i64, &v49, &v47);
v16 = 0;
v13 = v14;
if( v14 >= 0 )
{
if( (int)PnpCtxRegQueryInfoKey(v15, KeyHandle, 0i64, &v37, 0i64, &v40, &NumberOfBytes) < 0 )
{
v18 = 0;
}
else
{
v17 = v40;
if( v37 > v40 )
v17 = v37;
v18 = 2 * v17 + 2;
v41 = v18;
if( 2 * v17 != -2 )
{
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v18, 0x62647050ui64);
if( !PoolWithTag )
{
v13 = -1073741670;
goto LABEL_85;
}
}
}
if( (!NumberOfBytes || (v12 = ExAllocatePoolWithTag(PagedPool, NumberOfBytes, 0x62647050ui64)) != 0i64)
&& (!v51
|| !(_DWORD)a7
|| (P = ExAllocatePoolWithTag(PagedPool, 8i64 * (unsigned int)a7, 0x62647050ui64)) != 0i64) )
{
for( i = 0; ; ++i )
{
v40 = i;
NumberOfBytes_4 = v18 >> 1;
v20 = RegRtlEnumKey(KeyHandle, i, PoolWithTag, &NumberOfBytes_4);
if( v20 == -2147483622 )
goto LABEL_60;
if( v20 == -1073741789 )
{
v18 = 2 * NumberOfBytes_4;
v41 = 2 * NumberOfBytes_4;
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v18, 0x62647050ui64);
if( PoolWithTag )
{
--i;
continue;
}
LABEL_58:
v13 = -1073741670;
goto LABEL_81;
}
if( v20 < 0 )
goto LABEL_59;
v22 = 0;
v37 = 0;
if( !v51 )
goto LABEL_44;
v23 = NumberOfBytes_4;
if( !NumberOfBytes_4 )
goto LABEL_43;
v24 = 0;
if( !v45 )
goto LABEL_42;
v25 = v51;
while( wcsnicmp(*v25, (const wchar_t *)PoolWithTag, (unsigned int)(v23 - 1)) )
{
LABEL_38:
++v24;
++v25;
if( v24 >= v45 )
goto LABEL_41;
}
v26 = (__int64)&(*v25)[v23];
v27 = *(_WORD *)(v26 - 2);
if( v27 )
break;
LODWORD(v23) = 0;
LABEL_41:
i = v40;
v22 = v37;
LABEL_42:
v18 = v41;
if( !(_DWORD)v23 )
{
v16 = 0;
continue;
}
LABEL_43:
v16 = 0;
LABEL_44:
if( !v52 )
goto LABEL_51;
v20 = SysCtxRegOpenKey(0i64, v52, (const WCHAR *)PoolWithTag, 0, 0x20019u, &Handle);
if( v20 == -1073741772 )
{
Handle = 0i64;
continue;
}
if( v20 < 0 )
{
LABEL_59:
v13 = v20;
LABEL_60:
if( v13 >= 0 )
{
v31 = NumberOfBytes;
while( 1 )
{
NumberOfBytes_4 = v18 >> 1;
NumberOfBytes = v31;
v32 = PnpCtxRegEnumValue(
v21,
KeyHandle,
v16,
PoolWithTag,
&NumberOfBytes_4,
(__int64)&v48,
v12,
(__int64)&NumberOfBytes);
if( v32 == -2147483622 )
break;
if( v32 == -1073741789 )
{
if( NumberOfBytes_4 > v18 >> 1 )
{
v18 = 2 * NumberOfBytes_4;
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v18, 0x62647050ui64);
if( !PoolWithTag )
goto LABEL_58;
}
v33 = NumberOfBytes;
if( NumberOfBytes > v31 )
{
v31 = NumberOfBytes;
if( v12 )
ExFreePoolWithTag(v12, 0);
v12 = ExAllocatePoolWithTag(PagedPool, v33, 0x62647050ui64);
if( !v12 )
goto LABEL_17;
}
--v16;
}
else
{
if( v32 < 0 )
{
v13 = v32;
goto LABEL_79;
}
if( v47 != 2
|| (v42 = 0,
(unsigned int)RegRtlQueryValue(v49, (const WCHAR *)PoolWithTag, 0i64, 0i64, (__int64)&v42) != -1073741789) )
{
v13 = RegRtlSetValue(v49, (const WCHAR *)PoolWithTag, v48, v12, NumberOfBytes);
if( v13 < 0 )
goto LABEL_79;
}
}
++v16;
}
}
goto LABEL_79;
}
v13 = PnpCtxRegQueryInfoKey(v21, Handle, &v46, 0i64, 0i64, 0i64, 0i64);
if( v13 < 0 )
goto LABEL_60;
if( !v46 )
{
ZwClose(Handle);
v29 = 0i64;
Handle = 0i64;
goto LABEL_52;
}
LABEL_51:
v29 = Handle;
LABEL_52:
LODWORD(v36) = v22;
LODWORD(ResultLength) = 0;
v30 = PiDrvDbOverlayCopyKeys(
KeyHandle,
(const WCHAR *)PoolWithTag,
v49,
(const WCHAR *)PoolWithTag,
(INT64)ResultLength,
(const WCHAR **)((unsigned __int64)P & -(__int64)(v22 != 0)),
v36,
v29);
v13 = v30;
if( v30 == -2147483603 )
{
v13 = 0;
continue;
}
if( v30 < 0 )
goto LABEL_79;
}
if( v27 == 92 && P )
{
v28 = v37;
*((_QWORD *)P + v37) = v26;
v37 = v28 + 1;
}
goto LABEL_38;
}
LABEL_17:
v13 = -1073741670;
LABEL_79:
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
LABEL_81:
if( v12 )
ExFreePoolWithTag(v12, 0);
if( P )
ExFreePoolWithTag(P, 0);
}
}
LABEL_85:
if( KeyHandle )
ZwClose(KeyHandle);
if( v49 )
ZwClose(v49);
if( Handle )
ZwClose(Handle);
return(unsigned int)v13;
}Referenced by:
PiDrvDbOverlayCopyKeys
PiDrvDbOverlayNodeHive