PiDcInitUpdateProperties

VOID __stdcall PiDcInitUpdateProperties(){
  unsigned __int16 *PoolWithTag; 
  WCHAR v1; 
  NTSTATUS v2; 
  unsigned int v3; 
  UINT64 i; 
  NTSTATUS v5; 
  _WORD *v6; 
  unsigned __int16 v7; 
  int v8; 
  UINT64 j; 
  NTSTATUS v10; 
  int v11; 
  UINT64 Length; 
  UINT64 ResultLength; 
  HANDLE Handle; 
  struct _UNICODE_STRING DestinationString; 
  void *KeyHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  GUID Guid; 
  UINT64 Value; 
  GUID Buffer; 
  __int64 v21; 
  KeyHandle = 0i64;
  Handle = 0i64;
  LODWORD(ResultLength) = 0;
  LODWORD(Value) = 0;
  v21 = 0i64;
  DestinationString = 0i64;
  Guid = 0i64;
  Buffer = 0i64;
  PoolWithTag = (unsigned __int16 *)ExAllocatePoolWithTag(PagedPool, 0x218ui64, 0x47706E50ui64);
  if( PoolWithTag )
  {
    RtlInitUnicodeString(
      &DestinationString,
      L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainerPropertyUpdateEvents",
      v1);
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    v2 = ZwOpenKey(&KeyHandle, 8u, &ObjectAttributes);
    if( v2 != -1073741772 && v2 >= 0 )
    {
      v3 = 0;
      for( i = 0i64; ; i = v3 )
      {
        LODWORD(Length) = 536;
        v5 = ZwEnumerateKey(KeyHandle, i, KeyBasicInformation, PoolWithTag, Length, &ResultLength);
        if( v5 == -2147483622 )
          break;
        if( v5 < 0 )
          break;
        *(&ObjectAttributes.Length + 1) = 0;
        v6 = PoolWithTag + 8;
        memset(&ObjectAttributes.Attributes + 1, 0, 20);
        DestinationString.Buffer = PoolWithTag + 8;
        v7 = PoolWithTag[6];
        Handle = 0i64;
        DestinationString.Length = v7;
        DestinationString.MaximumLength = v7;
        ObjectAttributes.RootDirectory = KeyHandle;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 576;
        if( ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes) < 0 )
          break;
        v8 = 0;
        for( j = 0i64; ; j = (unsigned int)++v8 )
        {
          LODWORD(Length) = 536;
          v10 = ZwEnumerateValueKey(Handle, j, KeyValueFullInformation, PoolWithTag, Length, &ResultLength);
          v11 = v10;
          if( v10 == -2147483622 )
          {
            v11 = 0;
            goto LABEL_21;
          }
          if( v10 != -2147483643 )
          {
            if( v10 < 0 )
              goto LABEL_21;
            if( (unsigned int)(*(_DWORD *)v6 - 80) <= 0x12 )
            {
              *(_DWORD *)&DestinationString.Length = 4980812;
              DestinationString.Buffer = PoolWithTag + 10;
              if( RtlGUIDFromString(&DestinationString, &Guid) >= 0 )
              {
                DestinationString.Buffer = PoolWithTag + 49;
                DestinationString.Length = *v6 - 78;
                DestinationString.MaximumLength = DestinationString.Length;
                if( RtlUnicodeStringToInteger(&DestinationString, 0xAui64, &Value) >= 0 )
                {
                  LODWORD(v21) = Value;
                  Buffer = Guid;
                  if( *((_DWORD *)PoolWithTag + 1) == 4 && *((_DWORD *)PoolWithTag + 3) == 4 )
                    HIDWORD(v21) = *(_DWORD *)((char *)PoolWithTag + *((unsigned int *)PoolWithTag + 2));
                  else
                    HIDWORD(v21) = 0;
                  if( !RtlInsertElementGenericTableAvl(&PiDcUpdateProperties, &Buffer, 0x18ui64, 0i64) )
                    break;
                }
              }
            }
          }
        }
        v11 = -1073741670;
LABEL_21:
        ZwClose(Handle);
        Handle = 0i64;
        if( v11 < 0 )
          break;
        ++v3;
      }
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( Handle )
    ZwClose(Handle);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x47706E50u);
}

Referenced by: