ExpWatchLicenseInfoWork

INT64 __fastcall ExpWatchLicenseInfoWork(INT64 a1, INT64 a2, WCHAR a3){
  char v4; 
  void *v5; 
  int v6; 
  NTSTATUS v7; 
  unsigned int v8; 
  WCHAR *PoolWithTag; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int16 v13; 
  UINT64 v14; 
  unsigned __int64 v15; 
  WCHAR v16; 
  NTSTATUS v17; 
  unsigned int v18; 
  UINT64 i; 
  __int64 v20; 
  int v21; 
  NTSTATUS v22; 
  NTSTATUS v23; 
  INT64 result; 
  ULONG_PTR BugCheckParameter4; 
  INT64 DataSize; 
  UINT64 DataSizea; 
  UINT64 DataSizeb; 
  INT64 DataSizec; 
  INT64 Asynchroneous; 
  PVOID ChangeBuffer; 
  PVOID ChangeBuffera; 
  BOOL WatchSubtree; 
  struct _UNICODE_STRING DestinationString; 
  UINT64 ResultLength; 
  HANDLE KeyHandle; 
  HANDLE Handle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING ValueName; 
  __int128 KeyInformation; 
  __int128 v41; 
  __int128 v42; 
  Handle = 0i64;
  v4 = 0;
  KeyInformation = 0i64;
  LODWORD(ResultLength) = 0;
  v41 = 0i64;
  KeyHandle = 0i64;
  v42 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  DestinationString = 0i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ValueName = 0i64;
  if( !ExpSetupModeDetected )
  {
    RtlInitUnicodeString(&DestinationString, *(PCWSTR *)(a1 + 16), a3);
    v5 = *(void **)a1;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.RootDirectory = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    NtClose(v5);
    v6 = CmOpenKey((VOID **)a1, 131103i64, &ObjectAttributes, 0i64, 0i64, DataSize, Asynchroneous, (INT64)ChangeBuffer);
    if( v6 < 0 )
      KeBugCheckEx(0x9Au, 0x12ui64, v6, 0i64, 0i64);
    v7 = NtQueryKey(*(VOID **)a1, KeyFullInformation, &KeyInformation, 0x30ui64, &ResultLength);
    if( v7 < 0 )
      KeBugCheckEx(0x9Au, 0x13ui64, v7, 0i64, 0i64);
    v8 = 2 * DWORD2(v41) + 56;
    if( v8 < DWORD2(v41) || v8 < 2 * (unsigned __int64)(unsigned int)(DWORD2(v41) + 16) )
      v4 = 1;
    PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, v8, 0x2079654Bui64);
    if( !PoolWithTag || v4 )
      KeBugCheckEx(0x9Au, 0x14ui64, v8, 0i64, 0i64);
    v10 = *(_QWORD *)(a1 + 16);
    v11 = -1i64;
    v12 = -1i64;
    do
      ++v12;
    while( *(_WORD *)(v10 + 2 * v12 + 32) );
    v13 = 2 * (WORD4(v41) + v12);
    DestinationString.Length = v13;
    if( (unsigned int)v13 < DWORD2(v41) )
      goto LABEL_19;
    v14 = v13;
    v15 = -1i64;
    do
      ++v15;
    while( *(_WORD *)(v10 + 2 * v15 + 32) );
    if( v13 < v15 )
      goto LABEL_19;
    do
      ++v11;
    while( *(_WORD *)(v10 + 2 * v11 + 32) );
    if( v13 < (unsigned __int64)DWORD2(v41) + v11 )
    {
LABEL_19:
      v4 = 1;
      v14 = v13;
    }
    DestinationString.MaximumLength = v13;
    DestinationString.Buffer = (wchar_t *)ExAllocatePoolWithTag(NonPagedPoolNx, v14, 0x2079654Bui64);
    if( !DestinationString.Buffer || v4 )
      KeBugCheckEx(0x9Au, 0x14ui64, DestinationString.Length, 1ui64, 0i64);
    RtlInitUnicodeString(&ValueName, L"ConcurrentLimit", v16);
    LODWORD(DataSizea) = 4;
    v17 = NtSetValueKey(*(VOID **)a1, &ValueName, 0i64, 4ui64, (VOID *)(a1 + 8), DataSizea);
    if( v17 < 0 )
      KeBugCheckEx(0x9Au, 0x15ui64, v17, 0i64, 0i64);
    v18 = 0;
    for( i = 0i64; ; i = v18 )
    {
      LODWORD(BugCheckParameter4) = v8;
      v23 = NtEnumerateKey(*(VOID **)a1, i, KeyBasicInformation, PoolWithTag, BugCheckParameter4, &ResultLength);
      if( v23 == -2147483622 )
        break;
      if( v23 >= 0 )
      {
        PoolWithTag[((unsigned __int64)*((unsigned int *)PoolWithTag + 3) >> 1) + 8] = 0;
        wcscpy_s(DestinationString.Buffer, (unsigned __int64)DestinationString.MaximumLength >> 1, *(PWCHAR *)(a1 + 16));
        wcscat_s(DestinationString.Buffer, (unsigned __int64)DestinationString.MaximumLength >> 1, L"\\");
        wcscat_s(DestinationString.Buffer, (unsigned __int64)DestinationString.MaximumLength >> 1, PoolWithTag + 8);
        v20 = -1i64;
        do
          ++v20;
        while( DestinationString.Buffer[v20] );
        ObjectAttributes.Length = 48;
        DestinationString.Length = 2 * v20;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v21 = CmOpenKey(
                &KeyHandle,
                131103i64,
                &ObjectAttributes,
                0i64,
                0i64,
                DataSizec,
                Asynchroneous,
                (INT64)ChangeBuffera);
        if( v21 < 0 )
          KeBugCheckEx(0x9Au, 0x16ui64, v21, 0i64, 0i64);
        LODWORD(DataSizeb) = 4;
        v22 = NtSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, (VOID *)(a1 + 8), DataSizeb);
        if( v22 < 0 )
          KeBugCheckEx(0x9Au, 0x17ui64, v22, 0i64, 0i64);
        NtClose(KeyHandle);
      }
      ++v18;
    }
    ExFreePoolWithTag(PoolWithTag, 0);
    ExFreePoolWithTag(DestinationString.Buffer, 0);
  }
  LOBYTE(WatchSubtree) = 1;
  LOBYTE(Asynchroneous) = 1;
  LODWORD(result) = NtNotifyChangeKey(
                      *(HANDLE *)a1,
                      0i64,
                      (PIO_APC_ROUTINE)(a1 + 24),
                      (PVOID)1,
                      (PIO_STATUS_BLOCK)(a1 + 56),
                      0x10000005u,
                      Asynchroneous,
                      (PVOID)(a1 + 72),
                      4u,
                      WatchSubtree);
  if( (int)result < 0 )
    KeBugCheckEx(0x9Au, 0x18ui64, (int)result, 0i64, 0i64);
  if( !ExpSetupModeDetected )
  {
    LODWORD(result) = PsCreateSystemThreadEx(
                        &Handle,
                        0x1FFFFFui64,
                        0i64,
                        0i64,
                        0i64,
                        ExpExpirationThread,
                        (PVOID)0xC000026Ai64,
                        0i64,
                        0i64);
    if( (int)result >= 0 )
      LODWORD(result) = ZwClose(Handle);
  }
  return result;
}

Referenced by: