PiCMEnumerateSubKeys

VOID __fastcall PiCMEnumerateSubKeys(
        VOID *IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        VOID *IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize){
  UINT64 *BytesUsed; 
  unsigned int v5; 
  char *PoolWithTag; 
  __int64 v8; 
  unsigned int v9; 
  int v10; 
  int CachedContextBaseKey; 
  unsigned int v12; 
  unsigned int v13; 
  int v14; 
  int v15; 
  UINT64 v16; 
  UINT64 ExpectedOutputSize; 
  UINT64 IoctlOutputBufferSizea; 
  HANDLE KeyHandle; 
  INT64 v20[2]; 
  UINT64 v21; 
  unsigned int v22; 
  UINT64 *v23; 
  BytesUsed = v23;
  KeyHandle = 0i64;
  v5 = IoctlOutputBufferSize;
  v22 = 0;
  LODWORD(v23) = 0;
  *(_DWORD *)BytesUsed = 0;
  *(_OWORD *)v20 = 0i64;
  LODWORD(v21) = 0;
  PoolWithTag = 0i64;
  if( (int)PiCMCaptureEnumerateInputData(
              (UINT64)IoctlInputBuffer,
              IoctlInputBufferSize,
              (INT64)IoctlOutputBuffer,
              (INT64)v20) >= 0 )
  {
    if( HIDWORD(v20[0]) )
    {
LABEL_3:
      v8 = 3221225485i64;
      goto LABEL_4;
    }
    if( IoctlOutputBuffer && v5 >= 0x14 )
    {
      v9 = v5 - 20;
      if( v5 - 20 < 2 )
        goto LABEL_3;
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v9, 0x34706E50ui64);
      if( !PoolWithTag )
      {
        v8 = 3221225626i64;
        goto LABEL_4;
      }
      v22 = v9 >> 1;
      switch( LODWORD(v20[1]) )
      {
        case 1:
          v10 = 5;
          break;
        case 2:
          v10 = 7;
          break;
        case 3:
          v10 = 8;
          break;
        default:
          goto LABEL_3;
      }
      CachedContextBaseKey = PnpCtxGetCachedContextBaseKey(PiPnpRtlCtx, v10, (__int64 *)&KeyHandle);
      v8 = (unsigned int)CachedContextBaseKey;
      if( CachedContextBaseKey < 0 )
        goto LABEL_4;
      v12 = HIDWORD(v20[1]);
      v13 = RegRtlEnumKey(KeyHandle, HIDWORD(v20[1]), PoolWithTag, &v22);
      v8 = v13;
      if( v13 == -2147483622 )
      {
        if( LODWORD(v20[1]) != 3 )
          goto LABEL_4;
        if( !CmIsStateSeparationEnabled() )
          goto LABEL_4;
        v14 = PnpCtxRegQueryInfoKey(v8, KeyHandle, &v23, 0i64, 0i64, 0i64, 0i64);
        v8 = (unsigned int)v14;
        if( v14 < 0 )
          goto LABEL_4;
        if( v12 < (unsigned int)v23 )
        {
          v8 = 3221225701i64;
          goto LABEL_4;
        }
        v15 = PnpCtxGetCachedContextBaseKey(PiPnpRtlCtx, 9, (__int64 *)&KeyHandle);
        v8 = (unsigned int)v15;
        if( v15 < 0 )
          goto LABEL_4;
        v8 = (unsigned int)RegRtlEnumKey(KeyHandle, v12 - (unsigned int)v23, PoolWithTag, &v22);
      }
    }
    else
    {
      v8 = 3221225485i64;
    }
    if( (int)v8 >= 0 )
    {
      LODWORD(IoctlOutputBufferSizea) = v5;
      LODWORD(ExpectedOutputSize) = v21;
      LODWORD(v16) = 2 * v22;
      PiCMReturnBufferResultData(
        v8,
        2 * v22,
        0i64,
        (UINT8 *)PoolWithTag,
        v16,
        ExpectedOutputSize,
        IoctlOutputBuffer,
        IoctlOutputBufferSizea,
        BytesUsed);
LABEL_5:
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0x34706E50u);
      return;
    }
LABEL_4:
    LODWORD(IoctlOutputBufferSizea) = v5;
    LODWORD(ExpectedOutputSize) = v21;
    LODWORD(v16) = 0;
    PiCMReturnBufferResultData(
      v8,
      2 * v22,
      0i64,
      0i64,
      v16,
      ExpectedOutputSize,
      IoctlOutputBuffer,
      IoctlOutputBufferSizea,
      BytesUsed);
    goto LABEL_5;
  }
}

Referenced by: