WmipGenerateBinaryMofNotification
VOID __stdcall WmipGenerateBinaryMofNotification(tagInstanceSet *BinaryMofInstanceSet, _GUID *Guid, _GUID *a3){
unsigned int v5;
tagInstanceSet *v6;
tagInstanceSet v7;
__int64 v8;
__int64 v9;
__int64 v10;
VOID **PoolWithTag;
VOID **v12;
UINT64 v13;
tagInstanceSet v14;
__int64 v15;
UINT64 dwFlags;
if( BinaryMofInstanceSet[18] )
{
v5 = 0;
v6 = BinaryMofInstanceSet + 22;
do
{
v7 = BinaryMofInstanceSet[4];
if( (v7 & 2) != 0 )
{
v15 = -1i64;
v10 = v5;
do
++v15;
while( *(_WORD *)(*(_QWORD *)(*((_QWORD *)BinaryMofInstanceSet + 11) + 8i64 * v5) + 2 * v15) );
v9 = 2 * v15 + 4;
}
else
{
if( (v7 & 1) == 0 )
return;
v8 = -1i64;
do
++v8;
while( *(_WORD *)(*(_QWORD *)v6 + 2 * v8 + 4) );
v9 = 2 * v8 + 14;
v10 = v5;
}
PoolWithTag = ExAllocatePoolWithTag(1ui64, v9 + 74, 1885957463i64);
v12 = PoolWithTag;
if( PoolWithTag )
{
memset(PoolWithTag, 0i64, v9 + 74);
*(_DWORD *)v12 = v9 + 74;
*((_DWORD *)v12 + 1) = 3;
v12[1] = (VOID *)1;
*((_DWORD *)v12 + 11) = 10;
*(_GUID *)(v12 + 3) = *Guid;
v12[2] = *(VOID **)&KUSER_SHARED_DATA.SystemTime.LowPart;
*((_DWORD *)v12 + 15) = v9 + 2;
v13 = v9 - 2;
*((_DWORD *)v12 + 12) = 64;
*((_DWORD *)v12 + 14) = 72;
*((_WORD *)v12 + 32) = 0;
*((_WORD *)v12 + 36) = 0;
v14 = BinaryMofInstanceSet[4];
if( (v14 & 2) != 0 )
{
*((_WORD *)v12 + 37) = v13;
RtlStringCbCopyW((WCHAR *)v12 + 38, v13, *(WCHAR **)(*(_QWORD *)v6 + 8 * v10));
}
else if( (v14 & 1) != 0 )
{
LODWORD(dwFlags) = 512;
RtlStringCbPrintfExW((WCHAR *)v12 + 38, v13, 0i64, 0i64, dwFlags, (WCHAR *)L"%ws%d");
*((_WORD *)v12 + 37) = v13;
}
WmipProcessEvent((_WNODE_HEADER *)v12, 1u, 0);
ExFreePoolWithTag(v12, 0);
v6 = BinaryMofInstanceSet + 22;
}
++v5;
}
while( v5 < BinaryMofInstanceSet[18] );
}
}Referenced by:
WmipAddDataSource
WmipDSCleanup
WmipUpdateDataSource