VfIrpLogRetrieveWmiData

NTSTATUS __stdcall VfIrpLogRetrieveWmiData(
        UINT64 SiloNumber,
        UINT8 *OutputBuffer,
        UINT64 *OffsetInstanceNameOffsets,
        UINT64 *InstanceCount,
        UINT64 *DataBlockOffset,
        UINT64 *TotalRequiredSize){
  __int64 v6; 
  VOID **PoolWithTag; 
  int v10; 
  __int64 *v11; 
  __int64 *v12; 
  __int64 *v13; 
  __int64 v14; 
  UINT8 *v15; 
  UINT8 *v16; 
  int v17; 
  VOID **v18; 
  VOID *v19; 
  unsigned __int16 v20; 
  unsigned int v21; 
  __int64 v22; 
  _OWORD *v23; 
  int v24; 
  int v25; 
  UINT8 *v26; 
  int v27; 
  UINT8 *v28; 
  int v29; 
  __int64 *v30; 
  __int64 *v31; 
  __int64 **v32; 
  UINT8 *v33; 
  int v34; 
  unsigned int v35; 
  int v36; 
  char *v37; 
  __int64 v38; 
  UINT64 NumberOfBytes; 
  PULONG ReturnLength; 
  int v41; 
  __int64 *v42; 
  UINT8 *v43; 
  __int64 v44; 

  v6 = (unsigned int)SiloNumber;
  LODWORD(NumberOfBytes) = 0;
  *(_DWORD *)OffsetInstanceNameOffsets = 0;
  *(_DWORD *)InstanceCount = 0;
  *(_DWORD *)DataBlockOffset = 0;
  *(_DWORD *)TotalRequiredSize = 0;
  ReturnLength = (PULONG)16;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x10ui64, 1950967382i64);
  if( !PoolWithTag )
    return -1073741670;
  v44 = 3 * v6;
  v10 = 0;
  v11 = (__int64 *)(ViIrpLogDatabase + 8 + 24 * v6);
  v12 = (__int64 *)*v11;
  if( (__int64 *)*v11 != v11 )
  {
    v13 = (__int64 *)*v11;
    do
    {
      ++v10;
      v13 = (__int64 *)*v13;
    }
    while( v13 != v11 );
  }
  v42 = (__int64 *)(ViIrpLogDatabase + 8 + 24 * v6);
  v14 = (unsigned int)(8 * v10 + 60 + 4 * v10);
  v15 = &OutputBuffer[8 * v10 + 60];
  v16 = &OutputBuffer[v14];
  v41 = 8 * v10 + 60;
  v17 = 0;
  while( v12 != v11 )
  {
    v17 = ObQueryNameString(
            (VOID *)*(v12 - 1),
            (_OBJECT_NAME_INFORMATION *)PoolWithTag,
            (unsigned int)ReturnLength,
            &NumberOfBytes);
    if( v17 == -1073741820 )
    {
      ExFreePoolWithTag(PoolWithTag, 0);
      v18 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1950967382i64);
      PoolWithTag = v18;
      if( !v18 )
        return -1073741670;
      v19 = (VOID *)*(v12 - 1);
      LODWORD(ReturnLength) = NumberOfBytes;
      v17 = ObQueryNameString(v19, (_OBJECT_NAME_INFORMATION *)v18, (unsigned int)NumberOfBytes, &NumberOfBytes);
    }
    if( v17 < 0 )
      break;
    v20 = *(_WORD *)PoolWithTag;
    if( *(_WORD *)PoolWithTag )
    {
      if( OutputBuffer )
      {
        *(_DWORD *)v15 = v14;
        v20 = *(_WORD *)PoolWithTag;
      }
      v21 = v20 + 18;
      v43 = v15 + 4;
      v22 = v21 >> 1;
      if( OutputBuffer )
        *(_WORD *)v16 = v21;
      v23 = v16 + 2;
      v24 = v14 + 2;
      if( OutputBuffer )
      {
        *v23 = *(_OWORD *)L"VERIFIER";
        memmove(v23 + 1, PoolWithTag[1], *(unsigned __int16 *)PoolWithTag);
        *((_WORD *)v23 + (unsigned int)(v22 - 1)) = 0;
      }
      v16 = (UINT8 *)v23 + 2 * v22;
      LODWORD(v14) = v21 + v24;
      v15 = v43;
    }
    else
    {
      *((_DWORD *)v12 + 4) |= 2u;
    }
    v42 = (__int64 *)*v42;
    v12 = (__int64 *)*v42;
  }
  ExFreePoolWithTag(PoolWithTag, 0);
  if( v17 < 0 )
    return v17;
  v25 = (v14 + 7) & 0xFFFFFFF8;
  v26 = OutputBuffer;
  v27 = v25;
  v28 = &OutputBuffer[v25];
  LODWORD(ReturnLength) = v25;
  v29 = 0;
  v30 = (__int64 *)(ViIrpLogDatabase + 8 * (v44 + 1));
  v31 = (__int64 *)*v30;
  v32 = (__int64 **)v30;
  if( (__int64 *)*v30 != v30 )
  {
    v33 = OutputBuffer + 60;
    do
    {
      v34 = *((_DWORD *)v31 + 4);
      if( (v34 & 2) == 0 )
      {
        ++v29;
        if( (v34 & 1) != 0 )
          v35 = *((_DWORD *)v31 + 6);
        else
          v35 = *((_DWORD *)v31 + 7);
        v36 = 40 * v35;
        if( v26 )
        {
          *(_DWORD *)v33 = v25;
          *((_DWORD *)v33 + 1) = v36 + 8;
          v33 += 8;
          *(_DWORD *)v28 = *((_DWORD *)v31 + 5);
          *((_DWORD *)v28 + 1) = v35;
          v37 = (char *)(v28 + 8);
          v38 = 40i64 * v35;
          memmove(v37, v31 + 4, 40 * v35);
          v26 = OutputBuffer;
          v28 = (UINT8 *)&v37[v38];
        }
        v31 = *v32;
        v25 += v36 + 8;
      }
      v32 = (__int64 **)v31;
      v31 = (__int64 *)*v31;
    }
    while( v31 != v30 );
    v27 = (int)ReturnLength;
  }
  *(_DWORD *)OffsetInstanceNameOffsets = v41;
  *(_DWORD *)InstanceCount = v29;
  *(_DWORD *)DataBlockOffset = v27;
  *(_DWORD *)TotalRequiredSize = v25;
  return 0;
}

Referenced by: