WmipInitializeDataStructs

NTSTATUS __stdcall WmipInitializeDataStructs(){
  __int64 v0; 
  NTSTATUS result; 
  __int64 *v2; 
  __int64 *i; 
  char NewMofResource[8]; 
  __int128 v5; 
  _BYTE v6[88]; 

  *(_QWORD *)&v5 = 0x11D23915E3DFF7BDi64;
  *(&ExBootDevicesRemovedEvent + 404) = (char *)&ExBootDevicesRemovedEvent + 3200;
  *(&ExBootDevicesRemovedEvent + 401) = (char *)&ExBootDevicesRemovedEvent + 3200;
  *(&ExBootDevicesRemovedEvent + 400) = (char *)&ExBootDevicesRemovedEvent + 3200;
  *(&ExBootDevicesRemovedEvent + 408) = (char *)&ExBootDevicesRemovedEvent + 3216;
  *(&ExBootDevicesRemovedEvent + 403) = (char *)&ExBootDevicesRemovedEvent + 3216;
  *(&ExBootDevicesRemovedEvent + 402) = (char *)&ExBootDevicesRemovedEvent + 3216;
  *(&ExBootDevicesRemovedEvent + 398) = (char *)&ExBootDevicesRemovedEvent + 3248;
  *(&ExBootDevicesRemovedEvent + 407) = (char *)&ExBootDevicesRemovedEvent + 3248;
  *(&ExBootDevicesRemovedEvent + 406) = (char *)&ExBootDevicesRemovedEvent + 3248;
  *((_QWORD *)&v5 + 1) = 0xA298B94FC0000391ui64;
  NewMofResource[0] = 0;
  v0 = WmipAllocRegEntry(-1i64, 1342177280i64);
  if( !v0 )
    return -1073741670;
  memset(v6, 0i64, sizeof(v6));
  *(_DWORD *)v6 = 88;
  *(_DWORD *)&v6[16] = 2;
  *(_DWORD *)&v6[24] = -943770160;
  *(_DWORD *)&v6[28] = 298953435;
  *(_OWORD *)&v6[56] = v5;
  *(_DWORD *)&v6[32] = -1610593601;
  *(_DWORD *)&v6[36] = 271124169;
  result = WmipAddDataSource((_REGENTRY *)v0, (WMIREGINFOW *)v6, 0x58ui64, 0i64, 0i64);
  if( result >= 0 )
  {
    v2 = (__int64 *)*(&ExBootDevicesRemovedEvent + 408);
    for( i = (__int64 *)**(&ExBootDevicesRemovedEvent + 408); i != v2; i = (__int64 *)*i )
      *((_DWORD *)i + 4) |= 1u;
    result = WmipAddMofResource(
               *(tagDATASOURCE **)(v0 + 32),
               (WCHAR *)L"kernelbase.dll",
               1u,
               (WCHAR *)L"MofResourceName",
               (UINT8 *)NewMofResource);
    if( result >= 0 )
      return 0;
  }
  return result;
}

Referenced by: