WmipPrepareWnodeSI

NTSTATUS __stdcall WmipPrepareWnodeSI(
        _WMIGUIDOBJECT *GuidObject,
        tagWNODE_SINGLE_INSTANCE *WnodeSI,
        UINT64 *ProviderIdCount,
        VOID **ProviderIdList,
        _BYTE *IsDynamic,
        _BYTE *InternalGuid){
  tagInstanceSet **v7; 
  __int64 v8; 
  tagInstanceSet **v9; 
  __int64 v10; 
  int v11; 
  wchar_t *v12; 
  __int64 v13; 
  INT64 v14; 
  int v15; 
  _DWORD *v17; 
  unsigned __int64 v18; 
  unsigned int v19; 
  const wchar_t *v20; 
  unsigned __int64 v21; 
  wchar_t *v22; 
  unsigned int v23; 
  _BYTE *v24; 
  ULONG v25; 
  __int64 v26; 
  _BYTE *v27; 
  volatile signed __int64 **v28; 
  wchar_t *Str1; 
  UINT64 PICountPtr; 
  tagInstanceSet **StaticPIPtr; 
  UINT64 PIMaxPtr; 
  tagInstanceSet **PIPtrPtr; 
  _BYTE *v34; 
  UINT64 *v35; 
  tagInstanceSet ***v36; 
  __int64 v37; 
  WCHAR pszDest[8]; 

  v35 = ProviderIdCount;
  v36 = (tagInstanceSet ***)ProviderIdList;
  v7 = 0i64;
  v8 = 0i64;
  v9 = 0i64;
  v34 = IsDynamic;
  StaticPIPtr = 0i64;
  *IsDynamic = 1;
  v10 = *((_QWORD *)GuidObject + 7);
  LODWORD(PICountPtr) = 0;
  if( !v10 || !*(_DWORD *)(v10 + 36) )
    return -1073741055;
  v11 = 0;
  WnodeSI->WnodeHeader.Guid = *(GUID *)(v10 + 72);
  if( (*(_DWORD *)(v10 + 16) & 1) != 0 )
  {
    *InternalGuid = 1;
  }
  else
  {
    *InternalGuid = 0;
    Str1 = WmipCountedToSz((WCHAR *)((char *)WnodeSI + WnodeSI->OffsetInstanceName));
    v12 = Str1;
    if( Str1 )
    {
      StaticPIPtr = *v36;
      v7 = StaticPIPtr;
      PIPtrPtr = StaticPIPtr;
      LODWORD(PIMaxPtr) = *(_DWORD *)v35;
      KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
      if( *(_DWORD *)(v10 + 36) )
      {
        v13 = v10 + 56;
        v14 = *(_QWORD *)(v10 + 56);
        v37 = v13;
        if( v14 != v13 )
        {
          do
          {
            if( (_BYTE)v9 )
              break;
            v15 = *(_DWORD *)(v14 + 16);
            if( (v15 & 0x89000) == 0 )
            {
              if( (v15 & 1) != 0 )
              {
                v17 = *(_DWORD **)(v14 + 88);
                v18 = -1i64;
                v19 = *v17;
                v20 = (const wchar_t *)(v17 + 1);
                do
                  ++v18;
                while( v20[v18] );
                v21 = -1i64;
                do
                  ++v21;
                while( Str1[v21] );
                if( v21 <= v18 || wcsnicmp(Str1, v20, v18) )
                {
                  v12 = Str1;
                }
                else
                {
                  v22 = &Str1[v18];
                  v23 = wtoi(v22);
                  if( WmipIsNumber(v22) )
                  {
                    if( v23 >= v19 && v23 < v19 + *(_DWORD *)(v14 + 72) && v23 < 0xF423F )
                    {
                      RtlStringCbPrintfW(pszDest, 0xEui64, (WCHAR *)L"%d");
                      if( !wcsicmp(pszDest, v22) )
                      {
                        WnodeSI->WnodeHeader.Flags |= 0x80u;
                        LOBYTE(v9) = 1;
                        WnodeSI->WnodeHeader.ProviderId = *(_DWORD *)(v14 + 80);
                        v24 = v34;
                        WnodeSI->InstanceIndex = v23 - v19;
                        *v24 = 0;
                      }
                    }
                  }
                  v12 = Str1;
                }
              }
              else if( (v15 & 2) != 0 )
              {
                v25 = 0;
                v26 = *(_QWORD *)(v14 + 88);
                if( *(_DWORD *)(v14 + 72) )
                {
                  while( wcsicmp(*(const wchar_t **)(v26 + 8i64 * v25), v12) )
                  {
                    if( ++v25 >= *(_DWORD *)(v14 + 72) )
                      goto LABEL_13;
                  }
                  WnodeSI->WnodeHeader.Flags |= 0x80u;
                  LOBYTE(v9) = 1;
                  WnodeSI->WnodeHeader.ProviderId = *(_DWORD *)(v14 + 80);
                  v27 = v34;
                  WnodeSI->InstanceIndex = v25;
                  *v27 = 0;
                }
              }
              else
              {
                WmipReferenceEntry(v14);
                v11 = WmipAddProviderIdToPIList(&PIPtrPtr, &PICountPtr, &PIMaxPtr, StaticPIPtr, (tagInstanceSet *)v14);
                if( v11 < 0 )
                  LOBYTE(v9) = 1;
              }
            }
LABEL_13:
            v14 = *(_QWORD *)v14;
          }
          while( v14 != v37 );
          v7 = PIPtrPtr;
          v8 = (unsigned int)PICountPtr;
        }
      }
      else
      {
        v11 = -1073741055;
      }
      ExFreePoolWithTag(v12, 0);
      KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
      v9 = StaticPIPtr;
    }
    else
    {
      v11 = -1073741670;
    }
    if( *v34 )
    {
      *(_DWORD *)v35 = v8;
      *v36 = v7;
    }
    else if( v7 )
    {
      if( (_DWORD)v8 )
      {
        v28 = (volatile signed __int64 **)v7;
        do
        {
          WmipUnreferenceEntry((__int64)&stru_140C00F40 + 4496, *v28++);
          --v8;
        }
        while( v8 );
        v9 = StaticPIPtr;
      }
      if( v7 != v9 )
        ExFreePoolWithTag(v7, 0);
    }
  }
  return v11;
}

Referenced by: