DrvDbGetObjectSubKeyCallback

__int64 __fastcall DrvDbGetObjectSubKeyCallback(__int64 a1, char *a2, const wchar_t *a3, __int64 a4){
  const wchar_t **v4; 
  __int64 v5; 
  int v6; 
  unsigned int v11; 
  WCHAR *PoolWithTag; 
  WCHAR *v13; 
  WCHAR *v14; 
  int v15; 
  NTSTRSAFE_PWSTR v16; 
  __int64 v17; 
  __int64 v18; 
  _OWORD *v19; 
  __int64 v20; 
  _OWORD *v21; 
  _OWORD *v22; 
  __int128 v23; 
  unsigned __int8(__fastcall *v24)(__int64, WCHAR *, _QWORD, _QWORD); 
  unsigned int v25; 
  unsigned int v26; 
  UINT64 dwFlags; 
  UINT64 dwFlagsa; 
  int v30; 
  HANDLE Handle; 
  size_t pcchRemaining; 
  NTSTRSAFE_PWSTR ppszDestEnd; 
  struct _UNICODE_STRING DestinationString; 
  int v35; 
  v4 = (const wchar_t **)&off_140007248;
  ppszDestEnd = 0i64;
  pcchRemaining = 0i64;
  v5 = 0i64;
  Handle = 0i64;
  v6 = 0;
  v35 = 0;
  v30 = 0;
  DestinationString = 0i64;
  while( wcsicmp(a3, *v4) )
  {
    ++v6;
    ++v4;
    if( v6 )
    {
      v11 = 256;
      PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x42444450ui64);
      v13 = PoolWithTag;
      if( !PoolWithTag )
        break;
      v14 = PoolWithTag;
      if( *(_WORD *)(a4 + 8) )
      {
        LODWORD(dwFlags) = 2304;
        if( (int)RtlStringCchCopyExW(PoolWithTag, 0x100ui64, (WCHAR *)(a4 + 8), &ppszDestEnd, &pcchRemaining, dwFlags) >= 0 )
        {
          v15 = pcchRemaining;
          if( pcchRemaining >= 2 )
          {
            v16 = ppszDestEnd;
            *ppszDestEnd = 92;
            v14 = v16 + 1;
            *v14 = 0;
            v11 = v15 - 2;
            goto LABEL_9;
          }
        }
LABEL_28:
        ExFreePoolWithTag(v13, 0);
        break;
      }
LABEL_9:
      if( RtlStringCchCopyW(v14, v11, (PWCHAR)a3) < 0 )
        goto LABEL_28;
      v17 = 0i64;
      if( a1 )
        v17 = *(_QWORD *)(a1 + 224);
      if( (int)SysCtxRegOpenKey(v17, a2, a3, 8u, 0x20019u, &Handle) < 0
        || (int)PnpCtxRegQueryInfoKey(v18, Handle, &v35, 0i64, &v30, 0i64, 0i64) < 0 )
      {
        goto LABEL_28;
      }
      if( v35 && *(_DWORD *)(a4 + 4) < *(_DWORD *)a4 )
      {
        v19 = ExAllocatePoolWithTag(PagedPool, 0x228ui64, 0x42444450ui64);
        v5 = (__int64)v19;
        if( !v19 )
          goto LABEL_28;
        v20 = 4i64;
        v21 = v19;
        v22 = (_OWORD *)a4;
        do
        {
          *v21 = *v22;
          v21[1] = v22[1];
          v21[2] = v22[2];
          v21[3] = v22[3];
          v21[4] = v22[4];
          v21[5] = v22[5];
          v21[6] = v22[6];
          v21 += 8;
          v23 = v22[7];
          v22 += 8;
          *(v21 - 1) = v23;
          --v20;
        }
        while( v20 );
        LODWORD(dwFlagsa) = 2304;
        *v21 = *v22;
        v21[1] = v22[1];
        *((_QWORD *)v21 + 4) = *((_QWORD *)v22 + 4);
        ++*(_DWORD *)(v5 + 4);
        RtlStringCchCopyExW((WCHAR *)(v5 + 8), 0x100ui64, v13, 0i64, 0i64, dwFlagsa);
        PnpCtxRegEnumKeyWithCallback(a1, Handle, (__int64)DrvDbGetObjectSubKeyCallback, v5);
        *(_QWORD *)(a4 + 536) = *(_QWORD *)(v5 + 536);
        *(_DWORD *)(a4 + 544) = *(_DWORD *)(v5 + 544);
        *(_DWORD *)(a4 + 548) = *(_DWORD *)(v5 + 548);
      }
      if( v30 )
      {
        v24 = *(unsigned __int8(__fastcall **)(__int64, WCHAR *, _QWORD, _QWORD))(a4 + 520);
        if( (!v24 || v24(a1, v13, 0i64, *(_QWORD *)(a4 + 528)))
          && (int)RtlInitUnicodeStringEx(&DestinationString, v13) >= 0 )
        {
          v25 = *(_DWORD *)(a4 + 544);
          v26 = DestinationString.MaximumLength >> 1;
          *(_DWORD *)(a4 + 548) += v26;
          if( v25 > v26 )
          {
            LODWORD(dwFlagsa) = 2304;
            RtlStringCchCopyExW(*(WCHAR **)(a4 + 536), v25, v13, 0i64, 0i64, dwFlagsa);
            *(_QWORD *)(a4 + 536) += 2i64 * v26;
            *(_DWORD *)(a4 + 544) -= v26;
          }
        }
      }
      if( v5 )
        ExFreePoolWithTag((PVOID)v5, 0);
      goto LABEL_28;
    }
  }
  if( Handle )
    ZwClose(Handle);
  return 0i64;
}

Referenced by: