AdtpBuildRegistryValueString

INT64 __fastcall AdtpBuildRegistryValueString(
        UINT64 Type,
        UINT64 DataLen,
        VOID *pData,
        _UNICODE_STRING *pResultantString,
        UINT8 *pFreeWhenDone){
  UINT64 v5; 
  UINT8 *v7; 
  unsigned int v8; 
  int v9; 
  const WCHAR *v10; 
  UINT8 v11; 
  UINT64 v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  __int64 v16; 
  __int16 *v17; 
  __int64 v18; 
  __int16 v19; 
  int v20; 
  unsigned int v21; 
  unsigned int v22; 
  unsigned int v23; 
  WCHAR v24; 
  wchar_t *v25; 
  unsigned __int64 v26; 
  UINT8 *PoolWithTag; 
  const WCHAR *v28; 
  unsigned __int16 Length; 
  unsigned __int16 MaximumLength; 
  wchar_t *Buffer; 
  UINT64 *pdwCurBufferIndex; 
  v5 = (unsigned int)DataLen;
  v7 = (UINT8 *)pData;
  v8 = 0;
  v9 = 0;
  v10 = 0i64;
  *pFreeWhenDone = 0;
  v11 = 1;
  switch( (_DWORD)Type )
  {
    case 4:
      if( (unsigned int)DataLen >= 4 )
      {
        v12 = *(unsigned int *)pData;
LABEL_7:
        v13 = AdtpBuildUlongString(v12, pResultantString, 0i64, 0i64, 0i64, pFreeWhenDone);
LABEL_11:
        v8 = v13;
        goto LABEL_51;
      }
      goto LABEL_37;
    case 5:
      if( (unsigned int)DataLen >= 4 )
      {
        v12 = _byteswap_ulong(*(_DWORD *)pData);
        goto LABEL_7;
      }
      goto LABEL_37;
    case 0xB:
      if( (unsigned int)DataLen >= 8 )
      {
        v13 = AdtpBuildHexInt64String(
                (UINT64 *)pData,
                pResultantString,
                (_EVENT_DATA_DESCRIPTOR *)pData,
                0i64,
                pdwCurBufferIndex,
                pFreeWhenDone);
        goto LABEL_11;
      }
      goto LABEL_37;
  }
  if( (unsigned int)(Type - 1) <= 1 )
  {
    if( (unsigned int)DataLen >= 2 && (v26 = (unsigned __int64)(unsigned int)DataLen >> 1, *((_WORD *)pData + v26 - 1)) )
    {
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)DataLen + 2i64, 0x6B416553ui64);
      v28 = (const WCHAR *)PoolWithTag;
      if( !PoolWithTag )
      {
LABEL_24:
        v8 = -1073741801;
        goto LABEL_52;
      }
      memmove(PoolWithTag, v7, v5);
      v28[v26] = 0;
    }
    else
    {
      v28 = (const WCHAR *)pData;
      v11 = 0;
      if( (unsigned int)DataLen < 2 )
        v28 = 0i64;
    }
    RtlInitUnicodeString(pResultantString, v28, (WCHAR)pData);
    *pFreeWhenDone = v11;
    Length = pResultantString->Length;
    if( pResultantString->Length >= (unsigned __int16)v5 )
      Length = v5;
    pResultantString->Length = Length;
    MaximumLength = pResultantString->MaximumLength;
    if( MaximumLength >= (unsigned __int16)v5 )
      MaximumLength = v5;
    pResultantString->MaximumLength = MaximumLength;
LABEL_51:
    if( (v8 & 0x80000000) == 0 )
      return v8;
    goto LABEL_52;
  }
  if( (_DWORD)Type != 7 )
  {
LABEL_37:
    v25 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, 0x1Aui64, 0x6B416553ui64);
    pResultantString->Buffer = v25;
    if( v25 )
    {
      *pFreeWhenDone = 1;
      *(_DWORD *)&pResultantString->Length = 1703936;
      v13 = AdtpBuildReplacementString(0x708ui64, pResultantString);
      goto LABEL_11;
    }
    v8 = -1073741801;
LABEL_52:
    if( *pFreeWhenDone )
    {
      Buffer = pResultantString->Buffer;
      if( Buffer )
        ExFreePoolWithTag(Buffer, 0);
    }
    *pFreeWhenDone = 0;
    return v8;
  }
  v14 = (unsigned int)DataLen >> 1;
  v15 = 0;
  if( (unsigned int)DataLen >> 1 )
  {
    do
    {
      v16 = v14 - 1;
      if( *((_WORD *)pData + v16) )
        break;
      if( v15 >= 2 )
        break;
      ++v15;
      --v14;
    }
    while( (_DWORD)v16 );
  }
  if( v14 )
  {
    v17 = (__int16 *)pData;
    v18 = v14;
    do
    {
      v19 = *v17;
      v20 = v9 + 1;
      ++v17;
      if( v19 != 42 )
        v20 = v9;
      v9 = v20;
      --v18;
    }
    while( v18 );
    v21 = v20 + v14;
    v10 = (const WCHAR *)ExAllocatePoolWithTag(PagedPool, 2i64 * (v20 + v14 + 1), 0x6B416553ui64);
    if( !v10 )
      goto LABEL_24;
    v22 = 0;
    v23 = 0;
    while( 1 )
    {
      if( v23 >= v21 )
      {
LABEL_34:
        v10[v23] = 0;
        goto LABEL_35;
      }
      v24 = *(_WORD *)v7;
      pData = (VOID *)(v23 + 1);
      if( !*(_WORD *)v7 )
        break;
      if( v24 != 42 )
      {
        v10[v23] = v24;
        goto LABEL_32;
      }
      v10[v23] = 42;
      v23 += 2;
      v10[(_QWORD)pData] = 42;
LABEL_33:
      ++v22;
      v7 += 2;
      if( v22 >= v14 )
        goto LABEL_34;
    }
    v10[v23] = 42;
LABEL_32:
    ++v23;
    goto LABEL_33;
  }
LABEL_35:
  RtlInitUnicodeString(pResultantString, v10, (WCHAR)pData);
  if( v10 )
    *pFreeWhenDone = 1;
  return v8;
}

Referenced by: