PipFindDeviceOverrideEntry

NTSTATUS __stdcall PipFindDeviceOverrideEntry(PWCHAR HardwareIds, PVOID DeviceOverrideMatchContext){
  VOID *v2; 
  __int64 v3; 
  VOID *v4; 
  PWCHAR v5; 
  __int64 v6; 
  __int64 v7; 
  unsigned int v8; 
  VOID **PoolWithTag; 
  wchar_t *v10; 
  const wchar_t *v11; 
  int v12; 
  NTSTATUS v13; 
  unsigned int v14; 
  const _UNICODE_STRING **v15; 
  const _UNICODE_STRING *i; 
  __int64 v17; 
  INT64 v19; 
  void *v20; 
  _UNICODE_STRING OutString; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _OBJECT_ATTRIBUTES v24; 
  VOID *Handle; 
  VOID *KeyHandle; 
  UINT64 HashValue; 

  HIDWORD(HashValue) = HIDWORD(v3);
  v4 = v2;
  v5 = HardwareIds;
  LODWORD(HashValue) = 0;
  OutString = 0i64;
  Handle = 0i64;
  DestinationString = 0i64;
  KeyHandle = 0i64;
  if( !*HardwareIds )
    return -1073741772;
  LODWORD(v6) = 0;
  do
  {
    v7 = -1i64;
    do
      ++v7;
    while( HardwareIds[v7] );
    v6 = (unsigned int)(v7 + v6 + 1);
    HardwareIds = &v5[v6];
  }
  while( *HardwareIds );
  v8 = v6 + 1;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 2i64 * v8, 1852403792i64);
  v10 = (wchar_t *)PoolWithTag;
  if( PoolWithTag )
  {
    memmove(PoolWithTag, v5, 2 * v8);
    OutString.Buffer = v10;
    OutString.Length = 2 * v8;
    OutString.MaximumLength = 2 * v8;
    IopReplaceSeperatorWithPound(&OutString, &OutString);
    v11 = v10;
    v12 = -1073741772;
    if( *v10 )
    {
      do
      {
        RtlInitUnicodeString(&DestinationString, v11);
        v13 = RtlHashUnicodeString(&DestinationString, 1u, 0i64, &HashValue);
        v14 = HashValue;
        v12 = -1073741772;
        if( v13 < 0 )
          v14 = 0;
        LODWORD(HashValue) = v14;
        v15 = (const _UNICODE_STRING **)(qword_140C50A20 + 16i64 * (v14 % dword_140C50A28));
        for( i = *v15; i != (const _UNICODE_STRING *)v15; i = *(const _UNICODE_STRING **)&i->Length )
        {
          if( (unsigned __int8)RtlEqualUnicodeString(&DestinationString, i + 1, 1u) )
          {
            v20 = Handle;
            if( !Handle )
            {
              *(_DWORD *)&OutString.Length = 8781956;
              *(_QWORD *)&ObjectAttributes.Length = 48i64;
              ObjectAttributes.ObjectName = &OutString;
              *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
              Handle = 0i64;
              ObjectAttributes.RootDirectory = 0i64;
              *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
              v12 = ZwOpenKey(
                      &Handle,
                      0x20019ui64,
                      &ObjectAttributes,
                      v19,
                      *(INT64 *)&OutString.Length,
                      (INT64)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\DeviceOverrides",
                      *(INT64 *)&DestinationString.Length,
                      (INT64)DestinationString.Buffer);
              if( v12 < 0 )
                goto LABEL_17;
              v20 = Handle;
            }
            v24.RootDirectory = v20;
            *(_QWORD *)&v24.Length = 48i64;
            v24.ObjectName = &DestinationString;
            *(_QWORD *)&v24.Attributes = 576i64;
            KeyHandle = 0i64;
            *(_OWORD *)&v24.SecurityDescriptor = 0i64;
            v12 = ZwOpenKey(
                    &KeyHandle,
                    0x20019ui64,
                    &v24,
                    v19,
                    *(INT64 *)&OutString.Length,
                    (INT64)OutString.Buffer,
                    *(INT64 *)&DestinationString.Length,
                    (INT64)DestinationString.Buffer);
            if( v12 >= 0 )
            {
              if( PipCallbackHasDeviceOverrides(KeyHandle, v4) )
                goto LABEL_15;
              ZwClose((_HANDLE)KeyHandle);
              v12 = -1073741772;
            }
            break;
          }
        }
        v17 = -1i64;
        do
          ++v17;
        while( v11[v17] );
        v11 += v17 + 1;
      }
      while( *v11 );
LABEL_15:
      if( v12 >= 0 )
        ZwClose((_HANDLE)KeyHandle);
    }
  }
  else
  {
    v12 = -1073741670;
  }
LABEL_17:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  return v12;
}

Referenced by: