WmipDereferenceEvent

unsigned int *__fastcall WmipDereferenceEvent(__int64 a1){
  int v1; 
  _DWORD *Buffer; 
  unsigned int v4; 
  INT64 i; 
  int v6; 
  int v7; 
  size_t v8; 
  unsigned int v9; 
  unsigned int v10; 
  unsigned int v11; 
  UINT64 v12; 
  VOID **PoolWithTag; 
  int v14; 
  _WORD *v15; 
  NTSTATUS v16; 
  int v17; 
  _IO_STATUS_BLOCK Iosb; 
  UINT64 Number; 
  unsigned int v21; 
  unsigned int v22; 
  UINT64 Size; 

  v1 = *(_DWORD *)(a1 + 4);
  Buffer = 0i64;
  v4 = 0;
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
  for( i = **(&ExBootDevicesRemovedEvent + 404); ; i = *(_QWORD *)i )
  {
    if( i == *(&ExBootDevicesRemovedEvent + 404) )
    {
      i = 0i64;
      goto LABEL_6;
    }
    if( *(_DWORD *)(i + 56) == v1 )
      break;
  }
  WmipReferenceEntry(i);
LABEL_6:
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
  if( i )
  {
    v6 = *(_DWORD *)(a1 + 44);
    LODWORD(Number) = 64;
    v7 = v6 & 0x80;
    if( v7 )
    {
      v8 = 0;
      v9 = 0;
    }
    else
    {
      v8 = *(unsigned __int16 *)(a1 + 68) + 2;
      if( !WmipAlign(2ui64, &Number) || (v9 = Number, v8 > ~(_DWORD)Number) )
      {
LABEL_28:
        WmipUnreferenceEntry((__int64)&stru_140C00F40 + 7664, (volatile signed __int64 *)i);
        return Buffer;
      }
      LODWORD(Number) = v8 + Number;
    }
    if( WmipAlign(8ui64, &Number) )
    {
      v10 = *(_DWORD *)(a1 + 64);
      if( v10 <= ~(_DWORD)Number )
      {
        v21 = 0;
        v11 = Number + v10;
        v12 = (unsigned int)Number + v10;
        v22 = Number + v10;
        while( 1 )
        {
          Size = v12;
          PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v12, 1885957463i64);
          Buffer = PoolWithTag;
          if( !PoolWithTag )
            break;
          memset(PoolWithTag, 0i64, Size);
          *Buffer = v11;
          Buffer[1] = *(_DWORD *)(a1 + 4);
          *(_OWORD *)(Buffer + 6) = *(_OWORD *)(a1 + 48);
          v14 = *(_DWORD *)(a1 + 8);
          Buffer[11] = v7 | 2;
          Buffer[14] = Number;
          Buffer[2] = v14;
          if( v7 )
          {
            Buffer[13] = *(_DWORD *)(a1 + 68);
          }
          else
          {
            v8 -= 2;
            Buffer[12] = v9;
            v15 = (_WORD *)((char *)Buffer + v9);
            *v15 = v8;
            memmove(v15 + 1, (const VOID *)(a1 + 70), v8);
          }
          v16 = WmipSendWmiIrp(1u, *(unsigned int *)(i + 56), Buffer + 6, v11, Buffer, &Iosb);
          if( v16 >= 0 )
          {
            v17 = Buffer[11];
            if( (v17 & 0x20) == 0 )
            {
              Buffer[11] = v17 | *(_DWORD *)(a1 + 44) & 0xFF000008 | 8;
              goto LABEL_28;
            }
            v4 = Buffer[12];
          }
          ExFreePoolWithTag(Buffer, 0);
          Buffer = 0i64;
          if( v16 >= 0 && v4 > v22 )
          {
            v11 = v4;
            v12 = v4;
            ++v21;
            v22 = v4;
            if( v21 < 2 )
              continue;
          }
          goto LABEL_28;
        }
      }
    }
    goto LABEL_28;
  }
  return Buffer;
}

Referenced by: