CmDeleteDeviceInterfaceRegKeyWorker
__int64 __fastcall CmDeleteDeviceInterfaceRegKeyWorker(__int64 a1, const WCHAR *a2, int a3, int a4, char a5){
const WCHAR *v7;
int v8;
wchar_t *PoolWithTag;
unsigned __int64 v11;
int DeviceInterfaceRegKeyPath;
const WCHAR *v13;
_QWORD *v14;
__int64 v15;
unsigned __int16 Length;
char *v18;
__int64 v19;
__int64 v20;
int v21;
__int64 v22;
__int64 v23;
int v24;
size_t cchDest;
HANDLE v26;
char *v27;
HANDLE Handle;
struct _UNICODE_STRING DestinationString;
__int64 v31;
LODWORD(v31) = 0;
v27 = 0i64;
v26 = 0i64;
v7 = a2;
Handle = 0i64;
v8 = 4;
PoolWithTag = 0i64;
DestinationString = 0i64;
if( !a3 || (a3 & 0xFFFFFCCC) != 0 )
goto LABEL_50;
LODWORD(v11) = (a3 & 0x200) != 0 ? 600 : 480;
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, (unsigned int)v11, 0x52504E50ui64);
if( PoolWithTag )
{
while( 1 )
{
LODWORD(cchDest) = (unsigned int)v11 >> 1;
DeviceInterfaceRegKeyPath = CmGetDeviceInterfaceRegKeyPath(
(unsigned int)v11 >> 1,
v7,
a3,
a4,
v24,
(__int64)PoolWithTag,
cchDest,
(__int64)&v31);
if( DeviceInterfaceRegKeyPath != -1073741789 )
break;
ExFreePoolWithTag(PoolWithTag, 0);
PoolWithTag = 0i64;
v11 = 2i64 * (unsigned int)v31;
if( v11 > 0xFFFFFFFF )
{
DeviceInterfaceRegKeyPath = -1073741675;
goto LABEL_10;
}
PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, (unsigned int)v11, 0x52504E50ui64);
if( !PoolWithTag )
goto LABEL_46;
v7 = a2;
}
}
else
{
LABEL_46:
DeviceInterfaceRegKeyPath = -1073741801;
}
if( DeviceInterfaceRegKeyPath < 0 )
goto LABEL_10;
if( (a3 & 0x100) != 0 )
{
v13 = PoolWithTag;
if( a1 )
v14 = *(_QWORD **)(a1 + 224);
else
v14 = 0i64;
DeviceInterfaceRegKeyPath = SysCtxRegOpenCurrentUserKey(v14, 0, 0x2000000u, &v26);
if( DeviceInterfaceRegKeyPath < 0 )
goto LABEL_10;
v18 = (char *)v26;
goto LABEL_25;
}
DeviceInterfaceRegKeyPath = RtlInitUnicodeStringEx(&DestinationString, PoolWithTag);
if( DeviceInterfaceRegKeyPath < 0 )
goto LABEL_10;
Length = DestinationString.Length;
if( DestinationString.Length >= (unsigned int)v11
|| DestinationString.Length <= 0x32u
|| !(unsigned __int8)RtlPrefixUnicodeString(
(PVOID)&`_CmDeleteDeviceContainerRegKeyWorker'::`2'::ObjectPathRootPrefix,
(INT64 *)&DestinationString) )
{
LABEL_50:
DeviceInterfaceRegKeyPath = -1073741811;
goto LABEL_10;
}
v13 = PoolWithTag + 25;
DestinationString.MaximumLength -= 50;
DestinationString.Buffer = PoolWithTag + 25;
DestinationString.Length = Length - 50;
if( (unsigned __int8)RtlPrefixUnicodeString(
(PVOID)&`_CmDeleteDeviceInterfaceRegKeyWorker'::`2'::DeviceClassesKeyPrefix,
(INT64 *)&DestinationString) )
{
v8 = 9;
v13 = PoolWithTag + 47;
}
else if( (unsigned __int8)RtlPrefixUnicodeString(
(PVOID)&`_CmDeleteDeviceInterfaceRegKeyWorker'::`2'::HardwareProfilesKeyPrefix,
(INT64 *)&DestinationString) )
{
v8 = 14;
v13 = PoolWithTag + 43;
}
DeviceInterfaceRegKeyPath = PnpCtxGetCachedContextBaseKey(a1, v8, (__int64 *)&v27);
if( DeviceInterfaceRegKeyPath >= 0 )
{
v18 = v27;
LABEL_25:
if( a3 == 49
|| (DeviceInterfaceRegKeyPath = CmOpenDeviceInterfaceRegKey(a1, a2, 0x30u, v15, 1, 0, (__int64)&Handle, 0i64),
DeviceInterfaceRegKeyPath >= 0) )
{
if( a5 )
{
if( a1 && (v19 = *(_QWORD *)(a1 + 224)) != 0 )
v20 = *(_QWORD *)(v19 + 8);
else
v20 = 0i64;
v21 = RegRtlDeleteTreeInternal(v18, v13, v20, 0);
}
else
{
if( a1 && (v22 = *(_QWORD *)(a1 + 224)) != 0 )
v23 = *(_QWORD *)(v22 + 8);
else
v23 = 0i64;
v21 = RegRtlDeleteKeyTransacted(v18, v13, v23);
}
if( (int)(v21 + 0x80000000) >= 0 && v21 != -1073741444 )
DeviceInterfaceRegKeyPath = v21;
}
}
LABEL_10:
if( Handle )
ZwClose(Handle);
if( v26 )
ZwClose(v26);
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
return(unsigned int)DeviceInterfaceRegKeyPath;
}Referenced by:
CmDeleteDeviceInterfaceRegKey