PopProcessWakeSourceWork

INT64 __fastcall PopProcessWakeSourceWork(INT64 a1, CHAR **a2, _QWORD *a3){
  __int64 v3; 
  _QWORD *v4; 
  __int64 v5; 
  unsigned int v6; 
  _QWORD **v7; 
  _QWORD *v8; 
  _QWORD *v9; 
  unsigned int v10; 
  unsigned __int16 *i; 
  unsigned __int16 *v12; 
  CHAR *v13; 
  CHAR *v14; 
  VOID *PoolWithTag; 
  void *v16; 
  UNICODE_STRING *v17; 
  v3 = *(_QWORD *)(a1 + 16);
  v4 = 0i64;
  if( v3 )
    v5 = *(_QWORD *)(*(_QWORD *)(v3 + 312) + 40i64);
  else
    v5 = 0i64;
  v6 = *(_DWORD *)(v5 + 152);
  v7 = (_QWORD **)(*(_QWORD *)(a1 + 24) + 24i64);
  v8 = *v7;
  while( v8 != v7 )
  {
    v9 = v8;
    v8 = (_QWORD *)*v8;
    if( !*((_DWORD *)v9 + 4) )
    {
      if( *((_DWORD *)v9 + 18) <= v6 )
      {
        if( *((_DWORD *)v9 + 18) < v6 )
        {
          for( i = *(unsigned __int16 **)(v5 + 16); ; i = (unsigned __int16 *)*((_QWORD *)v12 + 2) )
          {
            v12 = 0i64;
            if( i != IopRootDeviceNode )
              v12 = i;
            if( !v12 )
              break;
            if( v12[20] == *((_WORD *)v9 + 12)
              && !(unsigned int)wcsncmp(
                                  *((const WCHAR **)v12 + 6),
                                  (const WCHAR *)v9[4],
                                  (unsigned __int64)v12[20] >> 1) )
            {
              v4 = v9;
              goto LABEL_20;
            }
          }
        }
      }
      else if( PopWakeSourceIsParent((unsigned __int16 *)v5, (__int64)(v9 + 3)) )
      {
        v10 = -1073741823;
LABEL_24:
        v4 = 0i64;
        v14 = 0i64;
        goto LABEL_26;
      }
    }
  }
LABEL_20:
  v13 = PopNewWakeSource(0i64);
  v14 = v13;
  if( !v13 )
  {
    v10 = -1073741670;
    goto LABEL_24;
  }
  *((_DWORD *)v13 + 18) = v6;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, *(unsigned __int16 *)(v5 + 40), 0x206D654Dui64);
  *((_QWORD *)v14 + 4) = PoolWithTag;
  if( !PoolWithTag )
  {
    v10 = -1073741670;
    PopFreeWakeSource(v14, v16);
    goto LABEL_24;
  }
  *((_WORD *)v14 + 13) = *(_WORD *)(v5 + 40);
  RtlCopyUnicodeString((UNICODE_STRING *)(v14 + 24), (UNICODE_STRING *)(v5 + 40), v17);
  PopWakeSourceGetDeviceProperty((__int64)(v14 + 40), DevicePropertyFriendlyName, (_DEVICE_OBJECT *)v3);
  PopWakeSourceGetDeviceProperty((__int64)(v14 + 56), DevicePropertyDeviceDescription, (_DEVICE_OBJECT *)v3);
  v10 = 0;
LABEL_26:
  *a2 = v14;
  *a3 = v4;
  return v10;
}

Referenced by: