CmpMoveBiosAliasTable

__int64 __fastcall CmpMoveBiosAliasTable(
        void *a1,
        VOID *a2,
        unsigned int a3,
        int a4,
        WCHAR *Dst,
        __int64 a6,
        unsigned __int16 *KeyValueInformation){
  int v10; 
  int v11; 
  INT64 v12; 
  NTSTATUS v13; 
  unsigned int i; 
  INT64 v15; 
  INT64 v16; 
  INT64 v17; 
  __int64 v18; 
  INT64 v19; 
  NTSTATUS v20; 
  __int64 v21; 
  UINT64 Length; 
  UINT64 Lengtha; 
  INT64 Lengthb; 
  UINT64 Lengthc; 
  INT64 Lengthd; 
  UINT64 Lengthe; 
  INT64 Lengthi; 
  INT64 Lengthf; 
  UINT64 Lengthg; 
  INT64 Lengthh; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  UINT64 *ResultLengthb; 
  UINT64 *ResultLengthe; 
  UINT64 *ResultLengthc; 
  UINT64 *ResultLengthd; 
  INT64 v39; 
  UINT64 v40; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  VOID *KeyHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int Data; 
  void *v46; 
  __int128 KeyInformation; 
  __int128 v48; 
  __int128 v49; 

  v46 = a1;
  KeyHandle = 0i64;
  v39 = 0i64;
  Handle = 0i64;
  LODWORD(v40) = 0;
  DestinationString = 0i64;
  Data = a4;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeyInformation = 0i64;
  v48 = 0i64;
  v49 = 0i64;
  RtlInitUnicodeString(&DestinationString, L"SerialNumber");
  LODWORD(Length) = 256;
  if( ZwQueryValueKey(a2, &DestinationString, KeyValueFullInformation, KeyValueInformation, Length, &v40) >= 0
    && *((_DWORD *)KeyValueInformation + 1) == 4
    && (v10 = *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2)),
        RtlInitUnicodeString(&DestinationString, L"DockID"),
        LODWORD(Lengtha) = 256,
        ZwQueryValueKey(a2, &DestinationString, KeyValueFullInformation, KeyValueInformation, Lengtha, &v40) >= 0)
    && *((_DWORD *)KeyValueInformation + 1) == 4 )
  {
    v11 = *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2));
    RtlInitUnicodeString(&DestinationString, L"Alias");
    ObjectAttributes.RootDirectory = a1;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.Length = 48;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v12, Lengthb, (INT64)ResultLength, v39, v40) < 0 )
    {
      v13 = 0;
      KeyHandle = 0i64;
      goto LABEL_36;
    }
    v13 = ZwQueryKey(KeyHandle, KeyFullInformation, &KeyInformation, 0x30ui64, &v40);
    if( v13 >= 0 )
    {
      for( i = 0; i < DWORD1(v48); ++i )
      {
        LODWORD(Lengthc) = 254;
        v13 = ZwEnumerateKey(KeyHandle, i, KeyBasicInformation, KeyValueInformation, Lengthc, &v40);
        if( v13 < 0 )
          break;
        KeyValueInformation[((unsigned __int64)*((unsigned int *)KeyValueInformation + 3) >> 1) + 8] = 0;
        DestinationString.Length = KeyValueInformation[6];
        DestinationString.MaximumLength = DestinationString.Length + 2;
        DestinationString.Buffer = KeyValueInformation + 8;
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v13 = ZwOpenKey((VOID **)&v39, 0x2001Fui64, &ObjectAttributes, v15, Lengthd, (INT64)ResultLengtha, v39, v40);
        if( v13 < 0 )
          break;
        RtlInitUnicodeString(&DestinationString, L"ProfileNumber");
        LODWORD(Lengthe) = 256;
        v13 = ZwQueryValueKey(
                (VOID *)v39,
                &DestinationString,
                KeyValueFullInformation,
                KeyValueInformation,
                Lengthe,
                &v40);
        if( v13 < 0 || *((_DWORD *)KeyValueInformation + 1) != 4 )
          goto LABEL_33;
        if( a3 != *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2)) )
          goto LABEL_14;
        RtlInitUnicodeString(&DestinationString, L"DockID");
        LODWORD(Lengthc) = 256;
        v13 = ZwQueryValueKey(
                (VOID *)v39,
                &DestinationString,
                KeyValueFullInformation,
                KeyValueInformation,
                Lengthc,
                &v40);
        if( v13 < 0 || *((_DWORD *)KeyValueInformation + 1) != 4 )
          goto LABEL_33;
        if( v11 != *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2)) )
          goto LABEL_14;
        RtlInitUnicodeString(&DestinationString, L"SerialNumber");
        LODWORD(Lengthc) = 256;
        v13 = ZwQueryValueKey(
                (VOID *)v39,
                &DestinationString,
                KeyValueFullInformation,
                KeyValueInformation,
                Lengthc,
                &v40);
        if( v13 < 0 || *((_DWORD *)KeyValueInformation + 1) != 4 )
          goto LABEL_33;
        if( v10 == *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2)) )
        {
          RtlInitUnicodeString(&DestinationString, L"ProfileNumber");
          LODWORD(ResultLengthb) = 4;
          ZwSetValueKey((VOID *)v39, &DestinationString, 0i64, 4ui64, &Data, (UINT64)ResultLengthb);
          ZwClose(v39);
          v39 = 0i64;
          RtlInitUnicodeString(&DestinationString, L"Hardware Profiles");
          ObjectAttributes.RootDirectory = v46;
          ObjectAttributes.Length = 48;
          ObjectAttributes.ObjectName = &DestinationString;
          ObjectAttributes.Attributes = 576;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          if( ZwOpenKey(&Handle, 0x2001Fui64, &ObjectAttributes, v16, Lengthi, (INT64)ResultLengthe, v39, v40) < 0 )
            goto LABEL_32;
          swprintf_s(Dst, 0x80ui64, (WCHAR *)L"%04d", a3);
          RtlInitUnicodeString(&DestinationString, Dst);
          ObjectAttributes.RootDirectory = Handle;
          ObjectAttributes.Length = 48;
          ObjectAttributes.ObjectName = &DestinationString;
          ObjectAttributes.Attributes = 576;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          if( ZwOpenKey((VOID **)&v39, 0xF003Fui64, &ObjectAttributes, v17, Lengthf, (INT64)ResultLengthc, v39, v40) < 0 )
          {
            v39 = 0i64;
            goto LABEL_33;
          }
          RtlInitUnicodeString(&DestinationString, L"Cloned");
          LODWORD(Lengthg) = 256;
          v13 = ZwQueryValueKey(
                  (VOID *)v39,
                  &DestinationString,
                  KeyValueFullInformation,
                  KeyValueInformation,
                  Lengthg,
                  &v40);
          if( v13 < 0 || *((_DWORD *)KeyValueInformation + 1) != 4 )
            goto LABEL_33;
          if( *(_DWORD *)((char *)KeyValueInformation + *((unsigned int *)KeyValueInformation + 2)) )
          {
            ZwDeleteKey((VOID *)v39);
            ZwClose(v39);
            ZwClose((_HANDLE)Handle);
            Handle = 0i64;
            v39 = 0i64;
            if( (int)CmpOpenDevicesControlSet(v18, (VOID **)&v39, 0i64) < 0 )
              goto LABEL_32;
            ObjectAttributes.RootDirectory = (void *)v39;
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"\"$";
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            v20 = ZwOpenKey(&Handle, 0x2001Fui64, &ObjectAttributes, v19, Lengthc, (INT64)ResultLengthd, v39, v40);
            ZwClose(v39);
            v39 = 0i64;
            if( v20 < 0 )
            {
LABEL_32:
              Handle = 0i64;
              goto LABEL_33;
            }
            swprintf_s(Dst, 0x80ui64, (WCHAR *)L"%04d", a3);
            v13 = CmDeleteKeyRecursive(Handle, Dst, (__int64)KeyValueInformation, v21, Lengthh);
            ZwClose((_HANDLE)Handle);
            Handle = 0i64;
          }
          else
          {
            ZwClose(v39);
            ZwClose((_HANDLE)Handle);
            Handle = 0i64;
            v39 = 0i64;
          }
        }
        else
        {
LABEL_14:
          ZwClose(v39);
          v39 = 0i64;
        }
      }
    }
  }
  else
  {
LABEL_33:
    v13 = -1073741492;
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
LABEL_36:
  if( v39 )
    ZwClose(v39);
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return(unsigned int)v13;
}

Referenced by: