WmipGenerateBinaryMofNotification

void __fastcall WmipGenerateBinaryMofNotification(__int64 a1, _OWORD *a2){
  unsigned int v4; 
  _QWORD *v5; 
  int v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  char *PoolWithTag; 
  char *v11; 
  BOOL v12; 
  UINT64 v13; 
  int v14; 
  __int64 v15; 
  UINT64 dwFlags; 
  __int64 v17; 
  if( *(_DWORD *)(a1 + 72) )
  {
    v4 = 0;
    v5 = (_QWORD *)(a1 + 88);
    do
    {
      v6 = *(_DWORD *)(a1 + 16);
      if( (v6 & 2) != 0 )
      {
        v15 = -1i64;
        v9 = v4;
        do
          ++v15;
        while( *(_WORD *)(*(_QWORD *)(*(_QWORD *)(a1 + 88) + 8i64 * v4) + 2 * v15) );
        v8 = 2 * v15 + 4;
      }
      else
      {
        if( (v6 & 1) == 0 )
          return;
        v7 = -1i64;
        do
          ++v7;
        while( *(_WORD *)(*v5 + 2 * v7 + 4) );
        v8 = 2 * v7 + 14;
        v9 = v4;
      }
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v8 + 74, 0x70696D57ui64);
      v11 = PoolWithTag;
      if( PoolWithTag )
      {
        memset((INT64)PoolWithTag, 0i64);
        *(_DWORD *)v11 = v8 + 74;
        *((_DWORD *)v11 + 1) = 3;
        *((_QWORD *)v11 + 1) = 1i64;
        *((_DWORD *)v11 + 11) = 10;
        *(_OWORD *)(v11 + 24) = *a2;
        *((_QWORD *)v11 + 2) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
        *((_DWORD *)v11 + 15) = v8 + 2;
        v13 = v8 - 2;
        *((_DWORD *)v11 + 12) = 64;
        *((_DWORD *)v11 + 14) = 72;
        *((_WORD *)v11 + 32) = 0;
        *((_WORD *)v11 + 36) = 0;
        v14 = *(_DWORD *)(a1 + 16);
        if( (v14 & 2) != 0 )
        {
          *((_WORD *)v11 + 37) = v13;
          RtlStringCbCopyW((PWCHAR)v11 + 38, v13, *(PWCHAR *)(*v5 + 8 * v9));
        }
        else if( (v14 & 1) != 0 )
        {
          LODWORD(v17) = v4 + *(_DWORD *)*v5;
          LODWORD(dwFlags) = 512;
          RtlStringCbPrintfExW((WCHAR *)v11 + 38, v13, 0i64, 0i64, dwFlags, L"%ws%d", *v5 + 4i64, v17);
          *((_WORD *)v11 + 37) = v13;
        }
        LOBYTE(v12) = 1;
        WmipProcessEvent((WNODE_HEADER *)v11, v12, 0);
        ExFreePoolWithTag(v11, 0);
        v5 = (_QWORD *)(a1 + 88);
      }
      ++v4;
    }
    while( v4 < *(_DWORD *)(a1 + 72) );
  }
}

Referenced by: