WmipIncludeStaticNames
_WNODE_HEADER *__stdcall WmipIncludeStaticNames(_WNODE_HEADER *Wnode, UINT64 WnodeSize){
unsigned int v2;
_WNODE_HEADER *p_WnodeHeader;
INT64 v4;
tagGUIDENTRY *GEByGuid;
ULONG ProviderId;
INT64 i;
int v8;
unsigned int v9;
unsigned int v10;
unsigned int v11;
VOID **PoolWithTag;
tagWNODE_ALL_DATA *v13;
__int64 v14;
__int64 v15;
WCHAR *v16;
__int64 v17;
__int64 v18;
unsigned int v19;
__int64 v20;
__int64 v21;
VOID **v22;
_WORD *v23;
int v24;
unsigned int v25;
ULONG Flags;
UINT64 Number;
WCHAR pszDest[8];
v2 = WnodeSize;
p_WnodeHeader = Wnode;
v4 = 0i64;
if( (Wnode->Flags & 7) != 0 )
{
GEByGuid = WmipFindGEByGuid(&Wnode->Guid, 0);
if( GEByGuid )
{
ProviderId = p_WnodeHeader->ProviderId;
KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
for( i = *((_QWORD *)GEByGuid + 7); (tagGUIDENTRY *)i != GEByGuid + 14; i = *(_QWORD *)i )
{
if( *(_DWORD *)(i + 80) == ProviderId )
{
v4 = i;
WmipReferenceEntry(i);
break;
}
}
KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
WmipUnreferenceEntry((__int64)&stru_140C00F40 + 4528, (volatile signed __int64 *)GEByGuid);
if( v4 )
{
v8 = *(_DWORD *)(v4 + 16);
if( (v8 & 3) != 0 )
{
v9 = *(_DWORD *)(v4 + 72);
if( (p_WnodeHeader->Flags & 1) != 0 )
{
LODWORD(Number) = v2;
if( WmipAlign(4ui64, &Number) )
{
v10 = WmipStaticInstanceNameSize((tagInstanceSet *)v4);
if( v10 <= -1 - (int)Number )
{
v11 = v10 + Number;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v10 + (unsigned int)Number, 1885957463i64);
v13 = (tagWNODE_ALL_DATA *)PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, p_WnodeHeader, p_WnodeHeader->BufferSize);
WmipInsertStaticNames(v13, v11, (tagInstanceSet *)v4);
LABEL_34:
p_WnodeHeader = &v13->WnodeHeader;
goto LABEL_41;
}
}
}
}
else
{
v14 = p_WnodeHeader[1].ProviderId;
HIDWORD(Number) = v14;
if( (unsigned int)v14 < v9 )
{
v15 = *(_QWORD *)(v4 + 88);
if( (v8 & 2) != 0 )
{
v16 = *(WCHAR **)(v15 + 8 * v14);
v17 = -1i64;
v18 = -1i64;
do
++v18;
while( v16[v18] );
v19 = 2 * v18 + 4;
}
else
{
v16 = (WCHAR *)(v15 + 4);
v17 = -1i64;
v20 = -1i64;
do
++v20;
while( v16[v20] );
v19 = 2 * v20 + 16;
}
LODWORD(Number) = v2;
if( WmipAlign(2ui64, &Number) )
{
v21 = (unsigned int)Number;
if( v19 <= ~(_DWORD)Number )
{
v22 = ExAllocatePoolWithTag(1ui64, v19 + (unsigned int)Number, 1885957463i64);
v13 = (tagWNODE_ALL_DATA *)v22;
if( v22 )
{
memmove(v22, p_WnodeHeader, p_WnodeHeader->BufferSize);
v13->DataBlockOffset = v21;
v13->WnodeHeader.BufferSize = v19 + v21;
v23 = (_WORD *)((char *)v13 + v21);
v24 = *(_DWORD *)(v4 + 16);
v25 = v19 - 2;
if( (v24 & 2) != 0 )
{
*v23 = v25;
RtlStringCbCopyW(v23 + 1, v25, v16);
}
else
{
if( (v24 & 0x20000) != 0 )
v13->WnodeHeader.Flags |= 0x10000u;
RtlStringCbPrintfW(pszDest, 0xEui64, (WCHAR *)L"%d");
RtlStringCbCopyW(v23 + 1, v25, v16);
RtlStringCbCatW(v23 + 1, v25, pszDest);
do
++v17;
while( v23[v17 + 1] );
*v23 = 2 * (v17 + 1);
}
goto LABEL_34;
}
}
}
}
}
}
}
}
}
Flags = p_WnodeHeader->Flags;
if( (Flags & 1) != 0 && v2 >= 0x3C )
{
p_WnodeHeader[1].Version = 0;
}
else if( (Flags & 6) != 0 && v2 >= 0x34 )
{
p_WnodeHeader[1].BufferSize = 0;
}
LABEL_41:
if( v4 )
WmipUnreferenceEntry((__int64)&stru_140C00F40 + 4496, (volatile signed __int64 *)v4);
return p_WnodeHeader;
}Referenced by:
WmipProcessEvent