DrvDbGetObjectSubKeyCallback

PNPCTX_REG_ENUM_KEY_ACTION __stdcall DrvDbGetObjectSubKeyCallback(
        HPNPCTX *hPnpCtx,
        VOID *ParentKeyHandle,
        WCHAR *KeyName,
        VOID *Context){
  const wchar_t **v4; 
  INT64 v5; 
  int v6; 
  unsigned int v11; 
  VOID **PoolWithTag; 
  VOID **v13; 
  WCHAR *v14; 
  size_t v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  VOID **v19; 
  __int64 v20; 
  VOID **v21; 
  _OWORD *v22; 
  __int128 v23; 
  unsigned __int8(__fastcall *v24)(HPNPCTX *, VOID **, _QWORD, _QWORD); 
  unsigned int v25; 
  unsigned int v26; 
  UINT64 dwFlags; 
  UINT64 dwFlagsa; 
  int v30; 
  VOID *Handle; 
  size_t pcchRemaining[2]; 
  _NTSTRSAFE_PWSTR ppszDestEnd[2]; 
  _UNICODE_STRING DestinationString; 
  int v35; 

  v4 = (const wchar_t **)&off_140007248;
  *(_QWORD *)ppszDestEnd = 0i64;
  *(_QWORD *)pcchRemaining = 0i64;
  v5 = 0i64;
  Handle = 0i64;
  v6 = 0;
  v35 = 0;
  v30 = 0;
  DestinationString = 0i64;
  while( wcsicmp(KeyName, *v4) )
  {
    ++v6;
    ++v4;
    if( v6 )
    {
      v11 = 256;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x200ui64, 1111770192i64);
      v13 = PoolWithTag;
      if( !PoolWithTag )
        break;
      v14 = (WCHAR *)PoolWithTag;
      if( *((_WORD *)Context + 4) )
      {
        LODWORD(dwFlags) = 2304;
        if( RtlStringCchCopyExW(
               (WCHAR *)PoolWithTag,
               0x100ui64,
               (WCHAR *)Context + 4,
               (WCHAR **)ppszDestEnd,
               (UINT64 *)pcchRemaining,
               dwFlags) >= 0 )
        {
          v15 = pcchRemaining[0];
          if( *(_QWORD *)pcchRemaining >= 2ui64 )
          {
            v16 = *(_QWORD *)ppszDestEnd;
            **(_WORD **)ppszDestEnd = 92;
            v14 = (WCHAR *)(v16 + 2);
            *v14 = 0;
            v11 = v15 - 2;
            goto LABEL_9;
          }
        }
LABEL_28:
        ExFreePoolWithTag(v13, 0);
        break;
      }
LABEL_9:
      if( RtlStringCchCopyW(v14, v11, KeyName) < 0 )
        goto LABEL_28;
      v17 = 0i64;
      if( hPnpCtx )
        v17 = *((_QWORD *)hPnpCtx + 28);
      if( SysCtxRegOpenKey(v17, ParentKeyHandle, KeyName, 8u, 0x20019u, &Handle) < 0
        || (int)PnpCtxRegQueryInfoKey(v18, Handle, &v35, 0i64, &v30, 0i64, 0i64) < 0 )
      {
        goto LABEL_28;
      }
      if( v35 && *((_DWORD *)Context + 1) < *(_DWORD *)Context )
      {
        v19 = ExAllocatePoolWithTag(1ui64, 0x228ui64, 1111770192i64);
        v5 = (INT64)v19;
        if( !v19 )
          goto LABEL_28;
        v20 = 4i64;
        v21 = v19;
        v22 = Context;
        do
        {
          *(_OWORD *)v21 = *v22;
          *((_OWORD *)v21 + 1) = v22[1];
          *((_OWORD *)v21 + 2) = v22[2];
          *((_OWORD *)v21 + 3) = v22[3];
          *((_OWORD *)v21 + 4) = v22[4];
          *((_OWORD *)v21 + 5) = v22[5];
          *((_OWORD *)v21 + 6) = v22[6];
          v21 += 16;
          v23 = v22[7];
          v22 += 8;
          *((_OWORD *)v21 - 1) = v23;
          --v20;
        }
        while( v20 );
        LODWORD(dwFlagsa) = 2304;
        *(_OWORD *)v21 = *v22;
        *((_OWORD *)v21 + 1) = v22[1];
        v21[4] = (VOID *)*((_QWORD *)v22 + 4);
        ++*(_DWORD *)(v5 + 4);
        RtlStringCchCopyExW((WCHAR *)(v5 + 8), 0x100ui64, (WCHAR *)v13, 0i64, 0i64, dwFlagsa);
        PnpCtxRegEnumKeyWithCallback((INT64)hPnpCtx, Handle, (INT64)DrvDbGetObjectSubKeyCallback, v5);
        *((_QWORD *)Context + 67) = *(_QWORD *)(v5 + 536);
        *((_DWORD *)Context + 136) = *(_DWORD *)(v5 + 544);
        *((_DWORD *)Context + 137) = *(_DWORD *)(v5 + 548);
      }
      if( v30 )
      {
        v24 = (unsigned __int8(__fastcall *)(HPNPCTX *, VOID **, _QWORD, _QWORD))*((_QWORD *)Context + 65);
        if( (!v24 || v24(hPnpCtx, v13, 0i64, *((_QWORD *)Context + 66)))
          && RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)v13) >= 0 )
        {
          v25 = *((_DWORD *)Context + 136);
          v26 = DestinationString.MaximumLength >> 1;
          *((_DWORD *)Context + 137) += v26;
          if( v25 > v26 )
          {
            LODWORD(dwFlagsa) = 2304;
            RtlStringCchCopyExW(*((WCHAR **)Context + 67), v25, (WCHAR *)v13, 0i64, 0i64, dwFlagsa);
            *((_QWORD *)Context + 67) += 2i64 * v26;
            *((_DWORD *)Context + 136) -= v26;
          }
        }
      }
      if( v5 )
        ExFreePoolWithTag((PVOID)v5, 0);
      goto LABEL_28;
    }
  }
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return 0;
}

Referenced by: