PiDrvDbSetupNodeHive

__int64 __fastcall PiDrvDbSetupNodeHive(__int64 a1, WCHAR *a2, WCHAR a3){
  char v4; 
  INT64 v6; 
  NTSTATUS v7; 
  WCHAR v8; 
  int appended; 
  INT64 v10; 
  unsigned __int16 i; 
  __int64 Length; 
  unsigned __int64 v13; 
  wchar_t *Buffer; 
  NTSTATUS v15; 
  __int64 v17; 
  __int64 v18; 
  INT64 v19; 
  __int64 v20; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING HiveFileName; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING String1; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 

  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v4 = 0;
  DestinationString = 0i64;
  HiveFileName = 0i64;
  Destination = 0i64;
  String1 = 0i64;
  RtlInitUnicodeString(&DestinationString, a2);
  RtlInitUnicodeString(&HiveFileName, 0i64);
  RtlInitUnicodeString(&Destination, 0i64);
  if( !wcsicmp(a2, L"SYSTEM") )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)(a1 + 32);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = ZwOpenKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, v6, v17, v18, v19, v20);
    appended = v7;
LABEL_9:
    if( v7 < 0 )
      goto LABEL_38;
LABEL_34:
    appended = PiDrvDbResolveNodeFilePaths(a1, KeyHandle, v8);
    if( appended >= 0 && (*(_DWORD *)(a1 + 64) & 8) != 0 )
      appended = PiDrvDbOverlayNodeHive(a1, a2, KeyHandle);
    goto LABEL_38;
  }
  if( (*(_DWORD *)(a1 + 64) & 8) == 0 )
  {
    Destination.Length = 0;
    Destination.MaximumLength = DestinationString.Length + 38;
    Destination.Buffer = (wchar_t *)ExpAllocateStringRoutine((unsigned __int16)(DestinationString.Length + 38));
    if( !Destination.Buffer )
    {
LABEL_5:
      appended = -1073741670;
      goto LABEL_38;
    }
    appended = RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\REGISTRY\\MACHINE\\");
    if( appended < 0 )
      goto LABEL_38;
    appended = RtlAppendUnicodeStringToString(&Destination, &DestinationString);
    if( appended < 0 )
      goto LABEL_38;
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &Destination;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = ZwOpenKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, v10, v17, v18, v19, v20);
    appended = v7;
    if( v7 != -1073741772 )
      goto LABEL_9;
LABEL_37:
    appended = 0;
    goto LABEL_38;
  }
  if( !CmIsStateSeparationEnabled() )
    goto LABEL_37;
  HiveFileName.MaximumLength = DestinationString.Length + *(_WORD *)(a1 + 50);
  HiveFileName.Length = 0;
  HiveFileName.Buffer = (wchar_t *)ExpAllocateStringRoutine(HiveFileName.MaximumLength);
  if( !HiveFileName.Buffer )
    goto LABEL_5;
  appended = RtlAppendUnicodeStringToString(&HiveFileName, (_UNICODE_STRING *)(a1 + 48));
  if( appended >= 0 )
  {
    for( i = HiveFileName.Length; i > 2u; HiveFileName.Length = i )
    {
      if( HiveFileName.Buffer[((unsigned __int64)i >> 1) - 1] == 92 )
        break;
      i -= 2;
    }
    appended = RtlAppendUnicodeStringToString(&HiveFileName, &DestinationString);
    if( appended >= 0 )
    {
      Destination.MaximumLength = DestinationString.Length + *(_WORD *)(a1 + 34);
      Destination.Length = 0;
      Destination.Buffer = (wchar_t *)ExpAllocateStringRoutine(Destination.MaximumLength);
      if( !Destination.Buffer )
        goto LABEL_5;
      appended = RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)(a1 + 32));
      if( appended >= 0 )
      {
        RtlInitUnicodeString(&String1, L"DRIVERS");
        Length = String1.Length;
        v13 = Destination.Length;
        Buffer = Destination.Buffer;
        if( Destination.Length > (unsigned __int64)String1.Length + 2
          && RtlSuffixUnicodeString(&String1, &Destination, 1u)
          && Buffer[(((unsigned __int64)(unsigned int)v13 - Length) >> 1) - 1] != 92
          || (RtlInitUnicodeString(&String1, L"SYSTEM"),
              Length = String1.Length,
              v13 > (unsigned __int64)String1.Length + 2)
          && RtlSuffixUnicodeString(&String1, &Destination, 1u)
          && Buffer[((v13 - Length) >> 1) - 1] != 92 )
        {
          Destination.Length = v13 - Length;
        }
        appended = RtlAppendUnicodeStringToString(&Destination, &DestinationString);
        if( appended >= 0 )
        {
          v15 = PiDrvDbLoadHive(&Destination, &HiveFileName, (VOID **)0x2000);
          appended = v15;
          if( v15 != -1073741772 )
          {
            if( v15 < 0 )
              goto LABEL_38;
            if( (*(_DWORD *)(a1 + 492) & 2) == 0 || wcsicmp(a2, L"SOFTWARE") )
              v4 = 1;
            else
              PnpSetObjectProperty(
                *(&stru_140CF2E80 + 607),
                *(_QWORD *)(a1 + 24),
                7u,
                *(_QWORD *)(a1 + 72),
                0i64,
                (__int64)&DEVPKEY_DriverDatabase_SoftwareRegistryPath,
                18,
                (__int64)Destination.Buffer,
                Destination.Length + 2,
                0);
            goto LABEL_34;
          }
          goto LABEL_37;
        }
      }
    }
  }
LABEL_38:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  if( v4 )
    PiDrvDbUnloadHive(&Destination, 0i64);
  RtlFreeAnsiString(&HiveFileName);
  RtlFreeAnsiString(&Destination);
  return(unsigned int)appended;
}

Referenced by: