PiDrvDbOverlayNodeHive

NTSTATUS __stdcall PiDrvDbOverlayNodeHive(INT64 a1, const WCHAR *a2, VOID *a3){
  __int64 v6; 
  int v7; 
  int v8; 
  wchar_t **v9; 
  INT64 v10; 
  __int64 v11; 
  NTSTATUS v12; 
  __int64 v13; 
  int v14; 
  NTSTATUS v15; 
  NTSTATUS v16; 
  VOID **PoolWithTag; 
  unsigned int i; 
  NTSTATUS v19; 
  int v20; 
  int v21; 
  VOID *v22; 
  INT64 a5; 
  INT64 a5a; 
  INT64 a6; 
  UINT64 v27; 
  UINT64 v28; 
  INT64 a8; 
  UINT64 KeyNameLength; 
  int v31; 
  int v32; 
  VOID *hKey; 
  VOID *Handle; 
  INT64 v35; 
  UINT64 v36; 
  VOID *phkResult; 
  UINT64 v38; 
  INT64 v39[8]; 

  v38 = 0i64;
  memset(v39, 0i64, sizeof(v39));
  v36 = 0i64;
  v35 = 0i64;
  LODWORD(v6) = 0;
  hKey = 0i64;
  phkResult = 0i64;
  Handle = 0i64;
  v31 = 0;
  v32 = 0;
  HIDWORD(KeyNameLength) = 0;
  if( wcsicmp(a2, L"SYSTEM") )
  {
    if( !wcsicmp(a2, L"SOFTWARE") && (*(_DWORD *)(a1 + 492) & 0x20) == 0 )
      goto LABEL_3;
  }
  else
  {
    v7 = *(_DWORD *)(a1 + 492);
    if( (v7 & 0x10) == 0 )
    {
LABEL_3:
      v8 = 0;
      goto LABEL_48;
    }
    v9 = off_1409844C8;
    do
    {
      v10 = (INT64)*v9++;
      v11 = (unsigned int)v6;
      v6 = (unsigned int)(v6 + 1);
      v39[v11] = v10;
    }
    while( (unsigned int)v6 < 4 );
    if( (v7 & 0xC0) != 0 )
    {
      v12 = SysCtxRegOpenKey(0i64, a3, L"ControlSet001\\Services", 0, 0x20019u, &hKey);
      v8 = v12;
      if( v12 == -1073741772 )
      {
        hKey = 0i64;
      }
      else if( v12 < 0 )
      {
        goto LABEL_48;
      }
    }
    v39[v6] = (INT64)L"ControlSet001\\Services";
    LODWORD(v6) = v6 + 1;
  }
  v13 = (unsigned int)v6;
  v14 = v6 + 1;
  v39[v13] = (INT64)L"Setup\\ResolveFilePaths";
  v15 = SysCtxRegOpenKey(
          0i64,
          (VOID *)0x80000002i64,
          L"System\\CurrentControlSet\\Control\\StateSeparation\\PnP\\DriverHiveOverlays",
          0,
          0x20019u,
          (VOID **)&v36);
  v8 = v15;
  if( v15 == -1073741772 )
  {
    v36 = 0i64;
  }
  else
  {
    if( v15 < 0 )
      goto LABEL_48;
    v16 = SysCtxRegOpenKey(0i64, (VOID *)v36, a2, 0, 0x20019u, (VOID **)&v35);
    v8 = v16;
    if( v16 == -1073741772 )
    {
      v35 = 0i64;
    }
    else if( v16 < 0 )
    {
      goto LABEL_48;
    }
  }
  v8 = SysCtxRegOpenKey(0i64, (VOID *)0x80000002i64, a2, 0, 0x2001Fu, (VOID **)&v38);
  if( v8 >= 0 )
  {
    LODWORD(v27) = v14;
    v8 = PiDrvDbOverlayCopyKeys(a3, 0i64, (VOID *)v38, 0i64, a5, (const WCHAR **)v39, v27, (VOID *)v35);
    if( v8 >= 0 )
    {
      if( hKey )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x208ui64, 1650749520i64);
        if( !PoolWithTag )
        {
          v8 = -1073741670;
          goto LABEL_48;
        }
        for( i = 0; ; ++i )
        {
          LODWORD(KeyNameLength) = 260;
          v19 = RegRtlEnumKey(hKey, i, (WCHAR *)PoolWithTag, &KeyNameLength, a5a, a6, v28, a8);
          if( v19 == -2147483622 )
          {
LABEL_47:
            ExFreePoolWithTag(PoolWithTag, 0);
            goto LABEL_48;
          }
          if( v19 < 0 || SysCtxRegOpenKey(0i64, hKey, (const WCHAR *)PoolWithTag, 0, 0x20019u, &Handle) < 0 )
            continue;
          LODWORD(KeyNameLength) = 4;
          if( (int)RegRtlQueryValue(Handle, L"Type", (_DWORD *)&KeyNameLength + 1, &v31, (__int64)&KeyNameLength) < 0
            || KeyNameLength != 0x400000004i64 )
          {
            break;
          }
          KeyNameLength = 0x400000004i64;
          if( (int)RegRtlQueryValue(Handle, L"Start", (_DWORD *)&KeyNameLength + 1, &v32, (__int64)&KeyNameLength) < 0
            || KeyNameLength != 0x400000004i64 )
          {
            v20 = v31;
LABEL_35:
            v32 = 0;
            v21 = 0;
            goto LABEL_36;
          }
          v20 = v31;
          v21 = v32;
LABEL_36:
          ZwClose((_HANDLE)Handle);
          if( !v20 )
            continue;
          if( (v20 & 0xB) == 0 || v21 == 2 )
          {
            if( (*(_DWORD *)(a1 + 492) & 0x80u) == 0 )
              continue;
          }
          else if( (*(_DWORD *)(a1 + 492) & 0x40) == 0 )
          {
            continue;
          }
          v22 = phkResult;
          if( !phkResult )
          {
            LODWORD(a5a) = 131103;
            v8 = PnpCtxRegCreateKey(
                   0i64,
                   (VOID *)v38,
                   (WCHAR *)L"ControlSet001\\Services",
                   0i64,
                   a5a,
                   0i64,
                   &phkResult,
                   0i64);
            if( v8 < 0 )
              goto LABEL_47;
            v22 = phkResult;
          }
          LODWORD(v28) = 0;
          v8 = PiDrvDbOverlayCopyKeys(
                 hKey,
                 (const WCHAR *)PoolWithTag,
                 v22,
                 (const WCHAR *)PoolWithTag,
                 a5a,
                 0i64,
                 v28,
                 0i64);
          if( v8 < 0 )
            goto LABEL_47;
        }
        v20 = 0;
        v31 = 0;
        goto LABEL_35;
      }
    }
  }
LABEL_48:
  if( v35 )
    ZwClose(v35);
  if( v36 )
    ZwClose(v36);
  if( hKey )
    ZwClose((_HANDLE)hKey);
  if( phkResult )
    ZwClose((_HANDLE)phkResult);
  if( v38 )
    ZwClose(v38);
  return v8;
}

Referenced by: