ViDdiDispatchWmiQueryAllData

INT64 __fastcall ViDdiDispatchWmiQueryAllData(_DEVICE_OBJECT *DeviceObject, _IRP *Irp){
  __int64 v2; 
  INT64 result; 
  unsigned int v6; 
  unsigned int *v7; 
  __int64 v8; 
  NTSTATUS v9; 
  unsigned int v10; 
  int v11; 
  NTSTATUS v12; 
  unsigned int v13; 
  UINT64 TotalRequiredSize; 
  UINT64 InstanceCount; 
  UINT64 DataBlockOffset; 
  UINT64 OffsetInstanceNameOffsets; 
  v2 = *((_QWORD *)Irp + 23);
  LODWORD(OffsetInstanceNameOffsets) = 0;
  LODWORD(InstanceCount) = 0;
  LODWORD(DataBlockOffset) = 0;
  LODWORD(TotalRequiredSize) = 0;
  if( *(_DEVICE_OBJECT **)(v2 + 8) != DeviceObject )
    return 3221225659i64;
  if( RtlCompareMemory(*(VOID **)(v2 + 16), &GUID_VERIFIER_WMI_INTERFACE, 0x10ui64) != 16 )
    return 3221226133i64;
  v6 = *(_DWORD *)(v2 + 24);
  v7 = (unsigned int *)*((_QWORD *)DeviceObject + 8);
  if( v6 < 0x38 )
    return 3221225507i64;
  v8 = *(_QWORD *)(v2 + 32);
  *(_QWORD *)(v8 + 16) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
  LODWORD(result) = VfIrpLogLockDatabase(*v7);
  if( (int)result >= 0 )
  {
    v9 = VfIrpLogRetrieveWmiData(
           *v7,
           0i64,
           &OffsetInstanceNameOffsets,
           &InstanceCount,
           &DataBlockOffset,
           &TotalRequiredSize);
    if( v9 < 0 )
    {
      VfIrpLogUnlockDatabase(*v7);
      return(unsigned int)v9;
    }
    v10 = TotalRequiredSize + 72;
    LODWORD(TotalRequiredSize) = v10;
    if( v10 <= v6 )
    {
      v11 = InstanceCount;
      if( (_DWORD)InstanceCount )
      {
        v12 = VfIrpLogRetrieveWmiData(
                *v7,
                (UINT8 *)v8,
                &OffsetInstanceNameOffsets,
                &InstanceCount,
                &DataBlockOffset,
                &TotalRequiredSize);
        v11 = InstanceCount;
        v9 = v12;
        v10 = TotalRequiredSize;
      }
      VfIrpLogUnlockDatabase(*v7);
      if( v9 < 0 )
        return(unsigned int)v9;
      if( v11 )
      {
        *(_DWORD *)v8 = 72;
        v10 = 72;
        *(_DWORD *)(v8 + 60) = 0;
        *(_DWORD *)(v8 + 48) = 0;
        *(_DWORD *)(v8 + 56) = 0;
      }
      else
      {
        v13 = *(_DWORD *)(v8 + 44) & 0xFFFFFFEF;
        *(_DWORD *)v8 = v10;
        *(_DWORD *)(v8 + 44) = v13 | 1;
        *(_DWORD *)(v8 + 48) = DataBlockOffset;
        *(_DWORD *)(v8 + 56) = OffsetInstanceNameOffsets;
      }
      *(_DWORD *)(v8 + 52) = 0;
      *((_QWORD *)Irp + 7) = v10;
    }
    else
    {
      VfIrpLogUnlockDatabase(*v7);
      *(_DWORD *)(v8 + 44) |= 0x20u;
      *(_DWORD *)(v8 + 48) = v10;
      *((_QWORD *)Irp + 7) = 56i64;
    }
    return 0i64;
  }
  return result;
}

Referenced by: