PiUEventHandleRegistration

INT64 __stdcall PiUEventHandleRegistration(
        FILE_OBJECT *FileObject,
        PVOID Buffer,
        UINT64 InputBufferLength,
        UINT64 OutputBufferLength,
        IO_STATUS_BLOCK *IoStatus){
  __int64 **v5; 
  char v6; 
  __int64 **v9; 
  int v10; 
  int v11; 
  int v12; 
  PVOID *v13; 
  SIZE_T v14; 
  int v15; 
  int v16; 
  unsigned int v17; 
  __int64 *v18; 
  __int64 **v19; 
  int v21; 
  int v22; 
  int v23; 
  __int64 *v24; 
  __int64 **v25; 
  int v26; 
  int v27; 
  unsigned int v28; 
  __int64 *v29; 
  __int64 **v30; 
  int Object; 
  unsigned int v32; 
  __int64 *v33; 
  __int64 **v34; 
  _UNICODE_STRING *DeviceId; 
  void *RevocationDeviceObject[6]; 
  size_t pcchLength; 
  DeviceId = 0i64;
  v5 = 0i64;
  RevocationDeviceObject[0] = 0i64;
  v6 = 0;
  if( !Buffer || (_DWORD)InputBufferLength != 936 || (_DWORD)OutputBufferLength != 8 )
  {
    v10 = -1073741811;
    goto LABEL_25;
  }
  PiUEventInitClientRegistrationContext();
  v5 = v9;
  if( !v9 )
  {
    v10 = -1073741670;
LABEL_55:
    FileObject->FsContext2 = 0i64;
    return(unsigned int)v10;
  }
  v9[6] = (__int64 *)PsGetCurrentThreadProcessId();
  SeCaptureSubjectContext((_SECURITY_SUBJECT_CONTEXT *)(v5 + 7));
  v10 = RtlStringCchLengthW((STRSAFE_PCNZWCH)Buffer, 0x104ui64, &pcchLength);
  if( v10 < 0 )
    goto LABEL_52;
  if( *((_DWORD *)Buffer + 130) != 416 )
    goto LABEL_52;
  v11 = *((_DWORD *)Buffer + 132);
  if( v11 >= 4 )
    goto LABEL_52;
  v12 = *((_DWORD *)Buffer + 131);
  if( (v12 & 0xFFFFFFFC) != 0 || (v12 & 1) != 0 && v11 )
    goto LABEL_52;
  if( (v12 & 2) != 0 && (unsigned int)(v11 - 2) > 1 )
    goto LABEL_52;
  v13 = (PVOID *)((char *)Buffer + 536);
  if( v11 == 1 && (((unsigned __int64)*v13 + 1) & 0xFFFFFFFFFFFFFFFEui64) == 0 )
    goto LABEL_52;
  v14 = 200i64;
  if( v11 == 2 )
  {
    v10 = RtlStringCchLengthW((STRSAFE_PCNZWCH)Buffer + 268, 0xC8ui64, &pcchLength);
    if( v10 < 0 )
      goto LABEL_52;
  }
  if( *((_DWORD *)Buffer + 132) == 3 )
  {
    v10 = RtlStringCchLengthW((STRSAFE_PCNZWCH)Buffer + 268, v14, &pcchLength);
    if( v10 < 0 )
      goto LABEL_52;
  }
  *((_DWORD *)v5 + 33) = *((_DWORD *)Buffer + 132);
  v15 = *((_DWORD *)Buffer + 132);
  if( v15 )
  {
    v21 = v15 - 1;
    if( v21 )
    {
      v26 = v21 - 1;
      if( !v26 || v26 == 1 )
      {
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          goto LABEL_17;
        Object = PiDmGetObject(1i64, (WCHAR *)Buffer + 268, (INT64 *)v5 + 3);
        v10 = Object;
        if( Object >= 0 )
          goto LABEL_17;
LABEL_53:
        if( v5 )
          PiUEventFreeClientRegistrationContext(v5, v6);
        goto LABEL_55;
      }
    }
    else
    {
      PiUEventGetDeviceInstanceIdFromUserHandle(*v13, &DeviceId, (_DEVICE_OBJECT **)RevocationDeviceObject);
      if( v22 >= 0 )
      {
        v10 = PiDmGetObject(1i64, DeviceId->Buffer, (INT64 *)v5 + 3);
        if( v10 >= 0 )
        {
          v5[4] = (__int64 *)RevocationDeviceObject[0];
          *((_BYTE *)v5 + 40) = 0;
          goto LABEL_17;
        }
        goto LABEL_53;
      }
    }
LABEL_52:
    v10 = -1073741811;
    goto LABEL_53;
  }
  if( (*((_DWORD *)Buffer + 131) & 1) == 0 )
    *(_OWORD *)(v5 + 3) = *(_OWORD *)v13;
LABEL_17:
  *(_QWORD *)Buffer = v5[11];
  IoStatus->Information = 8i64;
  ExAcquireFastMutex(&PiUEventClientRegistrationListLock);
  v16 = *((_DWORD *)Buffer + 132);
  if( v16 )
  {
    v23 = v16 - 1;
    if( v23 )
    {
      v27 = v23 - 1;
      if( v27 )
      {
        if( v27 != 1 )
        {
          v10 = -1073741811;
          goto LABEL_23;
        }
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          v32 = 13;
        else
          v32 = PiUEventHashStringIntoBucket((PWCHAR)Buffer + 268);
        v33 = &PiUEventDevInstancePropertyClientList[2 * v32];
        v34 = (__int64 **)v33[1];
        if( *v34 == v33 )
        {
          ++PiUEventDevInstancePropertyClientCount;
          *v5 = v33;
          v5[1] = (__int64 *)v34;
          *v34 = (__int64 *)v5;
          v33[1] = (__int64)v5;
          goto LABEL_22;
        }
      }
      else
      {
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          v28 = 13;
        else
          v28 = PiUEventHashStringIntoBucket((PWCHAR)Buffer + 268);
        v29 = &PiUEventDevInstanceClientList[2 * v28];
        v30 = (__int64 **)v29[1];
        if( *v30 == v29 )
        {
          ++PiUEventDevInstanceClientCount;
          *v5 = v29;
          v5[1] = (__int64 *)v30;
          *v30 = (__int64 *)v5;
          v29[1] = (__int64)v5;
          goto LABEL_22;
        }
      }
    }
    else
    {
      v24 = &PiUEventDevHandleClientList[2 * (unsigned int)PiUEventHashStringIntoBucket((PWCHAR)v5[3][2])];
      v25 = (__int64 **)v24[1];
      if( *v25 == v24 )
      {
        ++PiUEventDevHandleClientCount;
        *v5 = v24;
        v5[1] = (__int64 *)v25;
        *v25 = (__int64 *)v5;
        v24[1] = (__int64)v5;
        goto LABEL_22;
      }
    }
LABEL_70:
    __fastfail(3u);
  }
  if( (*((_DWORD *)Buffer + 131) & 1) != 0 )
    v17 = 13;
  else
    v17 = PiUEventHashGuidIntoBucket((_GUID *)((char *)Buffer + 536));
  v18 = &PiUEventDevInterfaceClientList[2 * v17];
  v19 = (__int64 **)v18[1];
  if( *v19 != v18 )
    goto LABEL_70;
  ++PiUEventDevInterfaceClientCount;
  *v5 = v18;
  v5[1] = (__int64 *)v19;
  *v19 = (__int64 *)v5;
  v18[1] = (__int64)v5;
LABEL_22:
  v6 = 1;
LABEL_23:
  KeReleaseGuardedMutex(&PiUEventClientRegistrationListLock);
  if( v10 < 0 )
    goto LABEL_53;
  FileObject->FsContext2 = v5;
LABEL_25:
  if( v10 < 0 )
    goto LABEL_53;
  return(unsigned int)v10;
}

Referenced by: