CmpAddDriverToList
CHAR __fastcall CmpAddDriverToList(UINT64 a1, INT64 a2, UINT64 a3, UINT64 a4, _UNICODE_STRING *Source, INT64 *a6){
char *v7;
char *v8;
__int64(__fastcall *v9)(UINT64, INT64, int *);
INT64 v10;
__int64 v11;
_WCHAR *NodeName;
_WCHAR *v13;
char *v14;
_UNICODE_STRING *v15;
_WORD *v16;
UINT16 v17;
unsigned int ValueByName;
_CM_KEY_VALUE *v19;
_CELL_DATA *v20;
size_t v21;
wchar_t *v22;
wchar_t *Buffer;
void(__fastcall *v24)(UINT64, _HV_GET_CELL_CONTEXT *);
__int64(__fastcall *v25)(_QWORD, _QWORD, __int64);
CHAR v26;
__int64 v27;
__int64 v28;
INT64 *v29;
INT64 v30;
unsigned int v31;
_CM_KEY_VALUE *v32;
_CELL_DATA *v33;
unsigned int v34;
_CM_KEY_VALUE *v35;
__int64 v36;
unsigned __int16 v37;
unsigned int v38;
unsigned int v39;
__int64(__fastcall *v41)(__int64, _QWORD, __int64);
__int64 v42;
_CM_KEY_VALUE *v43;
unsigned __int16 v44;
__int64 v45;
__int64 v46;
__int64 v47;
size_t Size;
__int64 v49;
int v50[2];
_UNICODE_STRING v51;
_UNICODE_STRING Destination;
_HV_GET_CELL_CONTEXT CellContext;
_HV_GET_CELL_CONTEXT v54;
_HV_GET_CELL_CONTEXT v55;
_HV_GET_CELL_CONTEXT v56;
int v57[2];
_UNICODE_STRING DestinationString[4];
UINT16 v59;
PVOID BugCheckParameter3;
unsigned int v61;
v61 = a4;
BugCheckParameter3 = (PVOID)a3;
v57[1] = 0;
*(_DWORD *)&v56.BinContext._bf_0 = 0;
v57[0] = -1;
v56.Cell = -1;
v55.Cell = -1;
*(_DWORD *)&v55.BinContext._bf_0 = 0;
v7 = 0i64;
v54.Cell = -1;
v8 = 0i64;
*(_DWORD *)&v54.BinContext._bf_0 = 0;
CellContext.Cell = -1;
*(_DWORD *)&CellContext.BinContext._bf_0 = 0;
v50[0] = -1;
v50[1] = 0;
v9 = *(__int64(__fastcall **)(UINT64, INT64, int *))(a1 + 8);
Size = 0;
DestinationString[0] = 0i64;
v59 = 0;
v51 = 0i64;
Destination = 0i64;
v10 = v9(a1, a2, v57);
v49 = v10;
v11 = v10;
if( !v10 )
{
v11 = 0i64;
goto LABEL_64;
}
NodeName = CmpGetNodeName(a1, v10, &v59);
v13 = NodeName;
if( !NodeName )
{
LABEL_64:
v26 = 0;
goto LABEL_36;
}
if( RtlInitUnicodeStringEx(DestinationString, NodeName) < 0
|| (v14 = (char *)(*(__int64(__fastcall **)(__int64, _QWORD, __int64))(a1 + 24))(144i64, 0i64, 540101955i64),
(v8 = v14) == 0i64) )
{
v26 = 0;
goto LABEL_34;
}
memset(v14, 0i64, 0x90u);
v15 = Source;
v16 = v8 + 120;
v17 = v59;
*((_QWORD *)v8 + 8) = a1;
v7 = v8;
*(_UNICODE_STRING *)(v8 + 72) = *v15;
*((_QWORD *)v8 + 5) = 0i64;
*((_QWORD *)v8 + 3) = 0i64;
*((_QWORD *)v8 + 16) = v13;
v13 = 0i64;
*((_WORD *)v8 + 60) = v17 - 2;
*((_WORD *)v8 + 61) = v17;
ValueByName = CmpFindValueByName(a1, v11, (__int64)&CmpImagePathString);
if( ValueByName == -1 )
{
v41 = *(__int64(__fastcall **)(__int64, _QWORD, __int64))(a1 + 24);
v42 = (unsigned int)(unsigned __int16)*v16 + 46;
v51.MaximumLength = *v16 + 46;
v51.Buffer = (wchar_t *)v41(v42, 0i64, 540233027i64);
if( !v51.Buffer )
{
v26 = 0;
goto LABEL_39;
}
if( RtlAppendUnicodeToString(&v51, (WCHAR *)L"System32\\Drivers\\") >= 0
&& RtlAppendUnicodeStringToString(&v51, (_UNICODE_STRING *)(v8 + 120)) >= 0
&& RtlAppendUnicodeToString(&v51, (WCHAR *)L".sys") >= 0 )
{
Buffer = v51.Buffer;
goto LABEL_10;
}
goto LABEL_64;
}
v19 = (_CM_KEY_VALUE *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(a1 + 8))(a1, ValueByName, v50);
if( !v19
|| (v20 = CmpValueToData((_HHIVE *)a1, ValueByName, v19, &Size, &CellContext),
*(_QWORD *)&DestinationString[0].Length = v20,
(*(void(__fastcall **)(UINT64, int *))(a1 + 16))(a1, v50),
!v20) )
{
v11 = v49;
v26 = 0;
LABEL_36:
Buffer = v51.Buffer;
goto LABEL_37;
}
v21 = Size;
v22 = (wchar_t *)(*(__int64(__fastcall **)(_QWORD, _QWORD, __int64))(a1 + 24))(Size, 0i64, 540233027i64);
v51.Buffer = v22;
Buffer = v22;
if( !v22 )
{
(*(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(a1 + 16))(a1, &CellContext);
v11 = v49;
v26 = 0;
goto LABEL_39;
}
memmove(v22, *(const VOID **)&DestinationString[0].Length, v21);
v24 = *(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(a1 + 16);
v51.Length = v21;
v51.MaximumLength = v21;
v24(a1, &CellContext);
v11 = v49;
LABEL_10:
v25 = *(__int64(__fastcall **)(_QWORD, _QWORD, __int64))(a1 + 24);
Destination.MaximumLength = *v16 + Source->Length + 92;
Destination.Buffer = (wchar_t *)v25(Destination.MaximumLength, 0i64, 540298563i64);
if( !Destination.Buffer
|| RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&CmpRegistryRootKeyPath) < 0
|| RtlAppendUnicodeStringToString(&Destination, Source) < 0
|| RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&CmpServicesSubKeyPath) < 0
|| (v26 = 0, RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)(v8 + 120)) < 0) )
{
v26 = 0;
goto LABEL_66;
}
v27 = *((_QWORD *)v8 + 3);
if( v27 )
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v27, *((unsigned __int16 *)v8 + 8));
v28 = *((_QWORD *)v8 + 5);
*((_UNICODE_STRING *)v8 + 1) = v51;
v51 = 0i64;
if( v28 )
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v28, *((unsigned __int16 *)v8 + 16));
v29 = a6;
*((_UNICODE_STRING *)v8 + 2) = Destination;
v30 = *v29;
Destination = 0i64;
if( *(INT64 **)(v30 + 8) != v29 )
__fastfail(3u);
*(_QWORD *)v8 = v30;
*((_QWORD *)v8 + 1) = v29;
*(_QWORD *)(v30 + 8) = v8;
v7 = 0i64;
*v29 = (INT64)v8;
v31 = CmpFindValueByName(a1, v11, (__int64)&CmpErrorControlString);
if( v31 == -1 )
{
*((_DWORD *)v8 + 35) = 1;
}
else
{
v32 = (_CM_KEY_VALUE *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(a1 + 8))(a1, v31, v50);
if( !v32 )
goto LABEL_56;
v33 = CmpValueToData((_HHIVE *)a1, v31, v32, &Size, &v54);
(*(void(__fastcall **)(UINT64, int *))(a1 + 16))(a1, v50);
if( !v33 )
goto LABEL_56;
*((_DWORD *)v8 + 35) = v33->u.KeyList[0];
(*(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(a1 + 16))(a1, &v54);
}
v34 = CmpFindValueByName(a1, v11, (__int64)&CmpGroupString);
if( v34 == -1 )
{
v36 = (__int64)(v8 + 104);
*((_WORD *)v8 + 52) = 0;
*((_WORD *)v8 + 53) = 0;
*((_QWORD *)v8 + 14) = 0i64;
goto LABEL_29;
}
v35 = (_CM_KEY_VALUE *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(a1 + 8))(a1, v34, v50);
if( v35 )
{
*((_QWORD *)v8 + 14) = CmpValueToData((_HHIVE *)a1, v34, v35, &Size, &v55);
(*(void(__fastcall **)(UINT64, int *))(a1 + 16))(a1, v50);
if( *((_QWORD *)v8 + 14) )
{
(*(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(a1 + 16))(a1, &v55);
v36 = (__int64)(v8 + 104);
v37 = Size - 2;
*((_WORD *)v8 + 52) = Size - 2;
if( v37 <= (unsigned __int16)Size )
{
*((_WORD *)v8 + 53) = v37;
LABEL_29:
v38 = CmpFindValueByName(a1, v11, (__int64)&CmpDriverDependencyString);
if( v38 == -1 )
{
*((_DWORD *)v8 + 22) = 0;
*((_QWORD *)v8 + 12) = 0i64;
LABEL_31:
v11 = v49;
v39 = CmpFindValueByName(a1, v49, (__int64)&CmpTagString);
if( v39 == -1 )
*((_DWORD *)v8 + 34) = -1;
else
*((_DWORD *)v8 + 34) = CmpFindTagIndex(BugCheckParameter3, v39, v61, v36);
v26 = 1;
LABEL_34:
v7 = 0i64;
if( v13 )
(*(void(__fastcall **)(_WCHAR *, _QWORD))(a1 + 32))(v13, v59);
goto LABEL_36;
}
v43 = (_CM_KEY_VALUE *)(*(__int64(__fastcall **)(UINT64, _QWORD, int *))(a1 + 8))(a1, v38, v50);
if( v43 )
{
*((_QWORD *)v8 + 12) = CmpValueToData((_HHIVE *)a1, v38, v43, &Size, &v56);
(*(void(__fastcall **)(UINT64, int *))(a1 + 16))(a1, v50);
if( *((_QWORD *)v8 + 12) )
{
(*(void(__fastcall **)(UINT64, _HV_GET_CELL_CONTEXT *))(a1 + 16))(a1, &v56);
v44 = Size - 2;
*((_WORD *)v8 + 44) = Size - 2;
if( v44 <= (unsigned __int16)Size )
{
*((_WORD *)v8 + 45) = v44;
goto LABEL_31;
}
}
}
}
}
}
LABEL_56:
Buffer = v51.Buffer;
LABEL_66:
v11 = v49;
LABEL_37:
if( Buffer )
(*(void(__fastcall **)(wchar_t *, _QWORD))(a1 + 32))(Buffer, v51.Length);
LABEL_39:
if( Destination.Buffer )
(*(void(__fastcall **)(wchar_t *, _QWORD))(a1 + 32))(Destination.Buffer, Destination.Length);
if( v7 )
{
v45 = *((_QWORD *)v7 + 3);
if( v45 )
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v45, *((unsigned __int16 *)v7 + 8));
v46 = *((_QWORD *)v7 + 5);
if( v46 )
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v46, *((unsigned __int16 *)v7 + 16));
v47 = *((_QWORD *)v8 + 16);
if( v47 )
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v47, *((unsigned __int16 *)v8 + 60));
(*(void(__fastcall **)(char *, __int64))(a1 + 32))(v8, 144i64);
}
if( v11 )
(*(void(__fastcall **)(UINT64, int *))(a1 + 16))(a1, v57);
return v26;
}Referenced by:
CmpFindDrivers