PiProcessDriverInstance

__int64 __fastcall PiProcessDriverInstance(const UNICODE_STRING *a1, _UNICODE_STRING *a2, char *a3){
  int DevInstMatch; 
  NTSTRSAFE_PWSTR v6; 
  wchar_t *Buffer; 
  char v8; 
  wchar_t *v9; 
  UINT8 *v10; 
  unsigned __int64 Length; 
  unsigned __int64 v12; 
  UINT8 *PoolWithTag; 
  signed __int64 v14; 
  bool v16; 
  UINT64 v17; 
  NTSTRSAFE_PCWSTR pszFormat; 
  NTSTRSAFE_PCWSTR pszFormata; 
  NTSTRSAFE_PCWSTR pszFormatb; 
  UINT64 Data; 
  struct _UNICODE_STRING ValueName; 
  UINT64 v23; 
  NTSTRSAFE_PWSTR ppszDestEnd; 
  struct _UNICODE_STRING UnicodeString; 
  wchar_t pszDest[12]; 
  LODWORD(Data) = 0;
  LODWORD(v23) = 0;
  ppszDestEnd = 0i64;
  UnicodeString = 0i64;
  ValueName = 0i64;
  DevInstMatch = PipOpenServiceEnumKeys(a2, 0xF003Fui64, 0i64, (PVOID *)&ppszDestEnd, 1u);
  if( DevInstMatch >= 0 )
  {
    v6 = ppszDestEnd;
    DevInstMatch = PiFindDevInstMatch(ppszDestEnd, (UNICODE_STRING *)a1, &Data, &UnicodeString, &v23);
    if( DevInstMatch < 0 )
    {
LABEL_17:
      ZwClose(v6);
      return(unsigned int)DevInstMatch;
    }
    Buffer = UnicodeString.Buffer;
    v8 = *a3;
    if( UnicodeString.Buffer )
    {
      if( v8 )
      {
LABEL_14:
        if( Buffer )
          RtlFreeAnsiString(&UnicodeString);
        goto LABEL_16;
      }
      ZwDeleteValueKey(v6, &UnicodeString);
      v16 = (_DWORD)Data == 1;
      v17 = (unsigned int)(Data - 1);
      LODWORD(Data) = Data - 1;
      if( !v16 )
        PiRearrangeDeviceInstances(v6, v17, (unsigned int)v23);
    }
    else
    {
      if( !v8 )
      {
LABEL_16:
        DevInstMatch = 0;
        goto LABEL_17;
      }
      v9 = a1->Buffer;
      v10 = 0i64;
      Length = a1->Length;
      v12 = Length >> 1;
      if( v9[(Length >> 1) - 1] )
      {
        PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(
                                 (_POOL_TYPE)(LODWORD(UnicodeString.Buffer) + 1),
                                 Length + 2,
                                 0x20207050ui64);
        v10 = PoolWithTag;
        if( PoolWithTag )
        {
          memmove(PoolWithTag, (UINT8 *)v9, (unsigned int)Length);
          LODWORD(Length) = Length + 2;
          *(_WORD *)&v10[2 * v12] = 0;
          v9 = (wchar_t *)v10;
        }
      }
      ppszDestEnd = pszDest;
      RtlStringCchPrintfExW(pszDest, 0xAui64, &ppszDestEnd, 0i64, 0i64, L"%u", Data);
      v14 = ppszDestEnd - pszDest;
      ValueName.MaximumLength = 20;
      if( (_DWORD)v14 == -1 )
        ValueName.Length = 20;
      else
        ValueName.Length = 2 * v14;
      LODWORD(pszFormata) = Length;
      ValueName.Buffer = pszDest;
      ZwSetValueKey(v6, &ValueName, 0i64, 1ui64, v9, (UINT64)pszFormata);
      if( v10 )
        ExFreePoolWithTag(v10, 0);
      LODWORD(Data) = Data + 1;
    }
    *(_DWORD *)&ValueName.Length = 786442;
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm8;
    LODWORD(pszFormat) = 4;
    ZwSetValueKey(v6, &ValueName, 0i64, 4ui64, &Data, (UINT64)pszFormat);
    LODWORD(pszFormatb) = 4;
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0.Xmm15;
    *(_DWORD *)&ValueName.Length = 1703960;
    ZwSetValueKey(v6, &ValueName, 0i64, 4ui64, &Data, (UINT64)pszFormatb);
    Buffer = UnicodeString.Buffer;
    goto LABEL_14;
  }
  return(unsigned int)DevInstMatch;
}

Referenced by: