VfIrpLogRetrieveWmiData

NTSTATUS __stdcall VfIrpLogRetrieveWmiData(
        UINT64 SiloNumber,
        UINT8 *OutputBuffer,
        UINT64 *OffsetInstanceNameOffsets,
        UINT64 *InstanceCount,
        UINT64 *DataBlockOffset,
        UINT64 *TotalRequiredSize){
  __int64 v6; 
  unsigned __int16 *PoolWithTag; 
  int v10; 
  __int64 *v11; 
  __int64 *v12; 
  __int64 *v13; 
  __int64 v14; 
  UINT8 *v15; 
  UINT8 *v16; 
  NTSTATUS v17; 
  _OBJECT_NAME_INFORMATION *v18; 
  VOID *v19; 
  unsigned __int16 v20; 
  unsigned int v21; 
  __int64 v22; 
  UINT8 *v23; 
  int v24; 
  ULONG v25; 
  UINT8 *v26; 
  ULONG v27; 
  UINT8 *v28; 
  int v29; 
  __int64 *v30; 
  __int64 *v31; 
  __int64 **v32; 
  UINT8 *v33; 
  int v34; 
  unsigned int v35; 
  int v36; 
  UINT8 *v37; 
  UINT64 v38; 
  UINT64 ReturnLength; 
  ULONG Length[2]; 
  int v41; 
  __int64 *v42; 
  UINT8 *v43; 
  __int64 v44; 
  v6 = (unsigned int)SiloNumber;
  LODWORD(ReturnLength) = 0;
  *(_DWORD *)OffsetInstanceNameOffsets = 0;
  *(_DWORD *)InstanceCount = 0;
  *(_DWORD *)DataBlockOffset = 0;
  *(_DWORD *)TotalRequiredSize = 0;
  *(_QWORD *)Length = 16i64;
  PoolWithTag = (unsigned __int16 *)ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x74496656ui64);
  if( !PoolWithTag )
    return -1073741670;
  v44 = 3 * v6;
  v10 = 0;
  v11 = (__int64 *)(ViIrpLogDatabase + 8 + 24 * v6);
  v12 = (__int64 *)*v11;
  if( (__int64 *)*v11 != v11 )
  {
    v13 = (__int64 *)*v11;
    do
    {
      ++v10;
      v13 = (__int64 *)*v13;
    }
    while( v13 != v11 );
  }
  v42 = (__int64 *)(ViIrpLogDatabase + 8 + 24 * v6);
  v14 = (unsigned int)(8 * v10 + 60 + 4 * v10);
  v15 = &OutputBuffer[8 * v10 + 60];
  v16 = &OutputBuffer[v14];
  v41 = 8 * v10 + 60;
  v17 = 0;
  while( v12 != v11 )
  {
    v17 = ObQueryNameString((VOID *)*(v12 - 1), (_OBJECT_NAME_INFORMATION *)PoolWithTag, Length[0], &ReturnLength);
    if( v17 == -1073741820 )
    {
      ExFreePoolWithTag(PoolWithTag, 0);
      v18 = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(PagedPool, (unsigned int)ReturnLength, 0x74496656ui64);
      PoolWithTag = &v18->Name.Length;
      if( !v18 )
        return -1073741670;
      v19 = (VOID *)*(v12 - 1);
      Length[0] = ReturnLength;
      v17 = ObQueryNameString(v19, v18, (unsigned int)ReturnLength, &ReturnLength);
    }
    if( v17 < 0 )
      break;
    v20 = *PoolWithTag;
    if( *PoolWithTag )
    {
      if( OutputBuffer )
      {
        *(_DWORD *)v15 = v14;
        v20 = *PoolWithTag;
      }
      v21 = v20 + 18;
      v43 = v15 + 4;
      v22 = v21 >> 1;
      if( OutputBuffer )
        *(_WORD *)v16 = v21;
      v23 = v16 + 2;
      v24 = v14 + 2;
      if( OutputBuffer )
      {
        *(_OWORD *)v23 = *(_OWORD *)L"VERIFIER";
        memmove(v23 + 16, *((UINT8 **)PoolWithTag + 1), *PoolWithTag);
        *(_WORD *)&v23[2 * (unsigned int)(v22 - 1)] = 0;
      }
      v16 = &v23[2 * v22];
      LODWORD(v14) = v21 + v24;
      v15 = v43;
    }
    else
    {
      *((_DWORD *)v12 + 4) |= 2u;
    }
    v42 = (__int64 *)*v42;
    v12 = (__int64 *)*v42;
  }
  ExFreePoolWithTag(PoolWithTag, 0);
  if( v17 < 0 )
    return v17;
  v25 = (v14 + 7) & 0xFFFFFFF8;
  v26 = OutputBuffer;
  v27 = v25;
  v28 = &OutputBuffer[v25];
  Length[0] = v25;
  v29 = 0;
  v30 = (__int64 *)(ViIrpLogDatabase + 8 * (v44 + 1));
  v31 = (__int64 *)*v30;
  v32 = (__int64 **)v30;
  if( (__int64 *)*v30 != v30 )
  {
    v33 = OutputBuffer + 60;
    do
    {
      v34 = *((_DWORD *)v31 + 4);
      if( (v34 & 2) == 0 )
      {
        ++v29;
        if( (v34 & 1) != 0 )
          v35 = *((_DWORD *)v31 + 6);
        else
          v35 = *((_DWORD *)v31 + 7);
        v36 = 40 * v35;
        if( v26 )
        {
          *(_DWORD *)v33 = v25;
          *((_DWORD *)v33 + 1) = v36 + 8;
          v33 += 8;
          *(_DWORD *)v28 = *((_DWORD *)v31 + 5);
          *((_DWORD *)v28 + 1) = v35;
          v37 = v28 + 8;
          v38 = 40i64 * v35;
          memmove(v37, (UINT8 *)v31 + 32, v38);
          v26 = OutputBuffer;
          v28 = &v37[v38];
        }
        v31 = *v32;
        v25 += v36 + 8;
      }
      v32 = (__int64 **)v31;
      v31 = (__int64 *)*v31;
    }
    while( v31 != v30 );
    v27 = Length[0];
  }
  *(_DWORD *)OffsetInstanceNameOffsets = v41;
  *(_DWORD *)InstanceCount = v29;
  *(_DWORD *)DataBlockOffset = v27;
  *(_DWORD *)TotalRequiredSize = v25;
  return 0;
}

Referenced by: