PpForEachDeviceInstanceDriver
NTSTATUS __stdcall PpForEachDeviceInstanceDriver(_UNICODE_STRING *DeviceInstancePath, VOID *Context){
__int64 v2;
__int64 v3;
VOID **PoolWithTag;
NTSTATUS result;
WCHAR *v7;
int DeviceRegProp;
UINT64 v9;
UINT8 v10;
unsigned int v11;
__int64 *v12;
char v13;
INT64 v14;
VOID *v15;
INT64 v16;
__int16 *v17;
NTSTATUS InstallerClassRegProp;
INT64 v19;
__int16 *v20;
VOID *v21;
INT64 v22;
NTSTATUS ObjectProperty;
UINT64 DesiredAccess;
VOID **DesiredAccessa;
UINT64 *Create;
UINT64 *Disposition;
UINT64 *Dispositiona;
UINT64 ValueSize;
UINT64 CmRegPropType;
VOID *Handle;
VOID *BaseKeyHandle;
WCHAR *DeviceInstanceId;
_DEVICE_SERVICE_ITERATOR_CONTEXT InternalContext[2];
NTSTATUS(__fastcall *v35)(_UNICODE_STRING *, _UNICODE_STRING *, CHAR *);
__int64 v36;
__int16 PropertyBuffer[40];
v3 = v2;
Handle = 0i64;
BaseKeyHandle = 0i64;
DeviceInstanceId = 0i64;
PoolWithTag = 0i64;
CmRegPropType = 0i64;
ValueSize = 0i64;
result = PnpUnicodeStringToWstr((__int16 **)&DeviceInstanceId, 0i64, &DeviceInstancePath->Length);
if( result >= 0 )
{
v7 = DeviceInstanceId;
LODWORD(DesiredAccess) = 131097;
DeviceRegProp = CmOpenDeviceRegKey(
*(&stru_140CF2E80 + 607),
DeviceInstanceId,
CM_KEY_TYPE_DEVICE_INSTANCE,
0i64,
DesiredAccess,
0,
&BaseKeyHandle,
0i64);
if( DeviceRegProp >= 0 )
{
LODWORD(Disposition) = 0;
HIDWORD(ValueSize) = 78;
DeviceRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
v7,
BaseKeyHandle,
9i64,
&CmRegPropType,
(UINT8 *)PropertyBuffer,
(UINT64 *)((char *)&ValueSize + 4),
(UINT64)Disposition);
if( DeviceRegProp >= 0 && (_DWORD)CmRegPropType == 1 && HIDWORD(ValueSize) )
{
Dispositiona = 0i64;
LOBYTE(Create) = 0;
LODWORD(DesiredAccessa) = 131097;
DeviceRegProp = CmOpenInstallerClassRegKey(
*(&stru_140CF2E80 + 607),
(WCHAR *)PropertyBuffer,
v9,
v10,
DesiredAccessa,
Create);
}
v36 = v3;
v35 = PiProcessDriverInstance;
HIDWORD(ValueSize) = 170;
*(_QWORD *)InternalContext = DeviceInstancePath;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xAAui64, 538996816i64);
if( PoolWithTag )
{
v11 = 0;
v12 = &qword_1400078E0;
while( 1 )
{
v13 = *((_BYTE *)v12 + 16);
if( v13 && !Handle )
goto LABEL_17;
v14 = v12[1];
LODWORD(ValueSize) = HIDWORD(ValueSize);
if( v13 )
{
if( v14 )
{
v15 = Handle;
v16 = 2i64;
v17 = PropertyBuffer;
goto LABEL_13;
}
InstallerClassRegProp = CmGetInstallerClassRegProp(
*(&stru_140CF2E80 + 607),
(const WCHAR *)PropertyBuffer,
Handle,
*(unsigned int *)v12,
&CmRegPropType,
(UINT8 *)PoolWithTag,
&ValueSize,
(UINT64)Dispositiona);
}
else
{
if( v14 )
{
v15 = BaseKeyHandle;
v16 = 1i64;
v17 = (__int16 *)v7;
LABEL_13:
InstallerClassRegProp = PnpGetObjectProperty(
*(&stru_140CF2E80 + 1214),
(INT64)v17,
v16,
(INT64)v15,
0i64,
v14,
(INT64)&CmRegPropType + 4,
(INT64)PoolWithTag);
goto LABEL_14;
}
LODWORD(Dispositiona) = 0;
InstallerClassRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
v7,
BaseKeyHandle,
*(unsigned int *)v12,
&CmRegPropType,
(UINT8 *)PoolWithTag,
&ValueSize,
(UINT64)Dispositiona);
}
LABEL_14:
DeviceRegProp = InstallerClassRegProp;
if( InstallerClassRegProp != -1073741789 )
goto LABEL_15;
ExFreePoolWithTag(PoolWithTag, 0);
HIDWORD(ValueSize) = ValueSize;
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ValueSize, 538996816i64);
if( !PoolWithTag )
break;
v19 = v12[1];
if( *((_BYTE *)v12 + 16) )
{
v20 = PropertyBuffer;
if( !v19 )
{
ObjectProperty = CmGetInstallerClassRegProp(
*(&stru_140CF2E80 + 607),
(const WCHAR *)PropertyBuffer,
Handle,
*(unsigned int *)v12,
&CmRegPropType,
(UINT8 *)PoolWithTag,
&ValueSize,
(UINT64)Dispositiona);
goto LABEL_46;
}
v21 = Handle;
v22 = 2i64;
}
else
{
v20 = (__int16 *)v7;
if( !v19 )
{
LODWORD(Dispositiona) = 0;
ObjectProperty = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
v7,
BaseKeyHandle,
*(unsigned int *)v12,
&CmRegPropType,
(UINT8 *)PoolWithTag,
&ValueSize,
(UINT64)Dispositiona);
goto LABEL_46;
}
v21 = BaseKeyHandle;
v22 = 1i64;
}
ObjectProperty = PnpGetObjectProperty(
*(&stru_140CF2E80 + 1214),
(INT64)v20,
v22,
(INT64)v21,
0i64,
v19,
(INT64)&CmRegPropType + 4,
(INT64)PoolWithTag);
LABEL_46:
DeviceRegProp = ObjectProperty;
LABEL_15:
if( DeviceRegProp == -1073741275 )
{
DeviceRegProp = 0;
}
else
{
if( DeviceRegProp < 0 )
goto LABEL_18;
DeviceRegProp = PiForEachDriverQueryRoutine(
(unsigned int)CmRegPropType,
PoolWithTag,
(unsigned int)ValueSize,
InternalContext);
if( DeviceRegProp < 0 )
goto LABEL_18;
}
LABEL_17:
++v11;
v12 += 3;
if( v11 >= 5 )
goto LABEL_18;
}
}
DeviceRegProp = -1073741670;
}
LABEL_18:
if( v7 )
PnpUnicodeStringToWstrFree(v7, (__int64)DeviceInstancePath);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
if( Handle )
ZwClose((_HANDLE)Handle);
if( BaseKeyHandle )
ZwClose((_HANDLE)BaseKeyHandle);
return DeviceRegProp;
}
return result;
}Referenced by:
PiDeviceRegistration