PnpDriverLoadingFailed

INT64 __stdcall PnpDriverLoadingFailed(PVOID ServiceHandle, UNICODE_STRING *ServiceName){
  int v2; 
  PVOID v4; 
  INT64 result; 
  unsigned int v6; 
  NTSTATUS RegistryValue; 
  unsigned int v8; 
  BOOL v9; 
  struct _DMA_ADAPTER *v10; 
  BOOL v11; 
  struct _DMA_ADAPTER *v12; 
  _DEVICE_NODE *FlushAdapterBuffers; 
  __int64 v14; 
  _ETHREAD *CurrentThread; 
  __int64 v16; 
  _PNP_DEVNODE_STATE *v17; 
  int v18; 
  _ETHREAD *v19; 
  int v20; 
  unsigned int i; 
  signed __int64 v22; 
  unsigned int *v23; 
  signed __int64 v24; 
  PVOID *Data; 
  UINT64 DataSize; 
  UINT64 DataSizea; 
  UINT64 DataSizeb; 
  UINT64 DataSizec; 
  __int64 v30; 
  struct _UNICODE_STRING ValueName; 
  void *KeyHandle; 
  unsigned int v33; 
  int v34; 
  PVOID P; 
  PVOID ServiceHandlea; 
  ULONG dwFlags; 
  NTSTRSAFE_PWSTR ppszDestEnd; 
  NTSTRSAFE_PWSTR v39; 
  PVOID v40[2]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  wchar_t pszDest[20]; 
  P = 0i64;
  v2 = 0;
  KeyHandle = 0i64;
  *(_DWORD *)(&ValueName.MaximumLength + 1) = 0;
  ServiceHandlea = ServiceHandle;
  v4 = ServiceHandle;
  v34 = 0;
  *(_OWORD *)v40 = 0i64;
  if( ServiceHandle )
  {
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm7;
    ObjectAttributes.RootDirectory = ServiceHandle;
    ObjectAttributes.ObjectName = &ValueName;
    *(_DWORD *)&ValueName.Length = 655368;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    LODWORD(result) = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  }
  else
  {
    LODWORD(result) = PipOpenServiceEnumKeys(ServiceName, 0x20019ui64, &ServiceHandlea, &KeyHandle, 0);
    v4 = ServiceHandlea;
    v2 = 1;
    v34 = 1;
  }
  if( (int)result >= 0 )
  {
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm13;
    *(_DWORD *)&ValueName.Length = 2097182;
    LODWORD(DataSize) = 4;
    dwFlags = 1;
    ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &dwFlags, DataSize);
    v6 = 0;
    RegistryValue = IopGetRegistryValue(
                      KeyHandle,
                      (PWCHAR)&stru_1407D01E0.Xmm8,
                      0i64,
                      (KEY_VALUE_FULL_INFORMATION **)&P);
    if( RegistryValue < 0 )
      goto LABEL_44;
    if( *((_DWORD *)P + 1) == 4 && *((_DWORD *)P + 3) >= 4u )
      v6 = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
    ExFreePoolWithTag(P, 0);
    if( v6 )
    {
      v8 = 0;
      v33 = v6;
      do
      {
        if( (int)PipServiceInstanceToDeviceInstance(v4, ServiceName, v8, (UNICODE_STRING *)v40, Data, DataSizea) >= 0 )
        {
          v10 = (struct _DMA_ADAPTER *)PnpDeviceObjectFromDeviceInstanceWithTag((INT64)v40, 0x746C6644ui64);
          v12 = v10;
          if( v10 )
          {
            FlushAdapterBuffers = (_DEVICE_NODE *)v10[19].DmaOperations->FlushAdapterBuffers;
            if( FlushAdapterBuffers )
            {
              if( !(unsigned int)PipIsDevNodeDNStarted(FlushAdapterBuffers) )
                IopReleaseDeviceResources(v14, 1);
            }
          }
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          --*((_WORD *)CurrentThread + 242);
          LOBYTE(v11) = 1;
          ExAcquireResourceSharedLite(&PnpRegistryDeviceResource, v11);
          if( v12 )
          {
            v16 = (__int64)v12[19].DmaOperations->FlushAdapterBuffers;
            if( v16 && (*(_DWORD *)(v16 + 396) & 1) != 0 && (unsigned int)(*(_DWORD *)(v16 + 300) - 775) <= 1 )
            {
              PoFxAbandonDevice((_DEVICE_NODE *)v16);
              PipSetDevNodeState((_DEVICE_NODE *)v16, DeviceNodeRemoved, v17);
              PipSetDevNodeProblem(v16, 24, 0);
            }
            HalPutDmaAdapter(v12);
          }
          ExFreePoolWithTag(v40[1], 0);
          ExReleaseResourceLite(&PnpRegistryDeviceResource);
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
          v4 = ServiceHandlea;
        }
        ++v8;
      }
      while( v8 < v6 );
      v18 = v34;
      if( v33 != v6 )
      {
        v19 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v19 + 242);
        LOBYTE(v9) = 1;
        ExAcquireResourceSharedLite(&PnpRegistryDeviceResource, v9);
        if( v33 )
        {
          v20 = 0;
          for( i = 0; i < v6; ++i )
          {
            LODWORD(v30) = i;
            ppszDestEnd = pszDest;
            RtlStringCchPrintfExW(pszDest, 0xAui64, &ppszDestEnd, 0i64, 0i64, L"%u", v30);
            ValueName.MaximumLength = 20;
            v22 = ppszDestEnd - pszDest;
            if( (_DWORD)v22 == -1 )
              ValueName.Length = 20;
            else
              ValueName.Length = 2 * v22;
            ValueName.Buffer = pszDest;
            if( IopGetRegistryValue(KeyHandle, pszDest, 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
            {
              v23 = (unsigned int *)P;
              if( i != v20 )
              {
                ZwDeleteValueKey(KeyHandle, &ValueName);
                LODWORD(v30) = v20;
                v39 = pszDest;
                RtlStringCchPrintfExW(pszDest, 0xAui64, &v39, 0i64, 0i64, L"%u", v30);
                ValueName.MaximumLength = 20;
                v24 = v39 - pszDest;
                if( (_DWORD)v24 == -1 )
                  ValueName.Length = 20;
                else
                  ValueName.Length = 2 * v24;
                ValueName.Buffer = pszDest;
                LODWORD(DataSizeb) = v23[3];
                ZwSetValueKey(KeyHandle, &ValueName, 0i64, 1ui64, (char *)v23 + v23[2], DataSizeb);
              }
              ExFreePoolWithTag(v23, 0);
              ++v20;
            }
          }
          v18 = v34;
        }
        ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm8;
        *(_DWORD *)&ValueName.Length = 786442;
        LODWORD(DataSizea) = 4;
        ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &v33, DataSizea);
        ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm15;
        LODWORD(DataSizec) = 4;
        *(_DWORD *)&ValueName.Length = 1703960;
        ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &v33, DataSizec);
        ExReleaseResourceLite(&PnpRegistryDeviceResource);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        v4 = ServiceHandlea;
      }
      ZwClose(KeyHandle);
      if( v18 )
        ZwClose(v4);
      return 0i64;
    }
    else
    {
LABEL_44:
      ZwClose(KeyHandle);
      if( v2 )
        ZwClose(v4);
      return(unsigned int)RegistryValue;
    }
  }
  return result;
}

Referenced by: