WmipAddDataSource
INT64 __fastcall WmipAddDataSource(INT64 a1, WMIREGINFOW *a2, UINT64 a3, WCHAR *a4, WCHAR *a5){
ULONG_PTR v5;
unsigned int v6;
INT64 v9;
_QWORD *v10;
WMIREGGUIDW *WmiRegGuid;
ULONG v12;
ULONG Flags;
int v14;
_QWORD *v15;
char v16;
int v17;
__int64 v18;
WCHAR *v19;
WCHAR *v20;
char *v22;
_QWORD **v23;
_QWORD *v24;
__int64 v25;
__int64 v26;
__int64 v27;
__int64 v28;
bool v29;
_QWORD *v30;
__int64 v31;
_QWORD *v32;
_QWORD *v33;
_QWORD *v34;
_QWORD *v35;
__int64 v36;
_QWORD *v37;
char v38[8];
__int64 v39;
__int128 v40;
__int128 v41;
char v42;
unsigned int v43;
v43 = a3;
v5 = *(_QWORD *)(a1 + 32);
v39 = 0i64;
v38[0] = 0;
v6 = a3;
v42 = 0;
v40 = 0i64;
v41 = 0i64;
if( !v5 )
{
v9 = WmipAllocEntry((INT64)&WmipDSChunkInfo);
v5 = v9;
if( v9 )
{
v10 = (_QWORD *)(v9 + 40);
*(_DWORD *)(v5 + 64) = 4;
v10[1] = v10;
*v10 = v10;
*(_QWORD *)(v5 + 72) = v5 + 80;
*(_OWORD *)(v5 + 80) = 0i64;
*(_OWORD *)(v5 + 96) = 0i64;
}
if( !v5 )
return(unsigned int)-1073741670;
*(_DWORD *)(v5 + 56) = *(_DWORD *)(a1 + 56);
v42 = 1;
}
WmiRegGuid = a2->WmiRegGuid;
v12 = 0;
if( !a2->GuidCount )
{
LABEL_10:
v14 = *(_DWORD *)(a1 + 48) & 0x40000000;
if( v14 )
{
*((_QWORD *)&v40 + 1) = &v40;
*(_QWORD *)&v40 = &v40;
*((_QWORD *)&v41 + 1) = &v41;
*(_QWORD *)&v41 = &v41;
}
v15 = (_QWORD *)((unsigned __int64)&v40 & -(__int64)(v14 != 0));
KeWaitForSingleObject(&WmipSMMutex, Executive, 0, 0, 0i64);
v16 = v42;
v17 = WmipLinkDataSourceToList(v5, v42, (__int64)v15);
KeReleaseMutex(&WmipSMMutex, 0);
if( v15 )
{
while( 1 )
{
v22 = (char *)*v15;
if( (_QWORD *)*v15 == v15 )
break;
if( *((_QWORD **)v22 + 1) != v15 )
goto LABEL_61;
v33 = *(_QWORD **)v22;
if( *(char **)(*(_QWORD *)v22 + 8i64) != v22 )
goto LABEL_61;
*v15 = v33;
v33[1] = v15;
WmipLegacyEtwWorker(*((VOID **)v22 + 2));
v34 = v22 + 40;
while( 1 )
{
v35 = (_QWORD *)*v34;
if( (_QWORD *)*v34 == v34 )
break;
if( (_QWORD *)v35[1] != v34 )
goto LABEL_61;
v36 = *v35;
if( *(_QWORD **)(*v35 + 8i64) != v35 )
goto LABEL_61;
*v34 = v36;
*(_QWORD *)(v36 + 8) = v34;
KeSetEvent((PRKEVENT)(v35 + 2), 0);
}
ExFreePoolWithTag(v22, 0x70696D57u);
}
v23 = (_QWORD **)(v15 + 2);
while( 1 )
{
v24 = *v23;
if( *v23 == v23 )
break;
if( (_QWORD **)v24[1] != v23 )
goto LABEL_61;
v37 = (_QWORD *)*v24;
if( *(_QWORD **)(*v24 + 8i64) != v24 )
goto LABEL_61;
*v23 = v37;
v37[1] = v23;
KeWaitForSingleObject(v24 + 4, Executive, 0, 0, 0i64);
ExFreePoolWithTag(v24, 0x70696D57u);
}
}
if( v17 >= 0 )
{
v18 = v39;
*(_QWORD *)(a1 + 32) = v5;
if( v18 )
WmipGenerateBinaryMofNotification(v18, &GUID_MOF_RESOURCE_ADDED_NOTIFICATION);
if( a4 )
v19 = WmipCountedToSz(a4);
else
v19 = 0i64;
if( a5 )
v20 = WmipCountedToSz(a5);
else
v20 = 0i64;
if( v19 )
{
if( *v19 && v20 && *v20 && (int)WmipAddMofResource(v5, v19, 0, v20, v38) >= 0 && v38[0] )
WmipGenerateMofResourceNotification(v19, v20, &GUID_MOF_RESOURCE_ADDED_NOTIFICATION, 1ui64);
ExFreePoolWithTag(v19, 0);
}
if( v20 )
ExFreePoolWithTag(v20, 0);
WmipGenerateRegistrationNotification(v5, 1);
v5 = 0i64;
v17 = 0;
}
goto LABEL_28;
}
while( 1 )
{
Flags = WmiRegGuid->Flags;
if( (Flags & 0x10000) != 0 || (Flags & 0x81000) == 0x80000 )
goto LABEL_9;
v25 = WmipAllocEntry((INT64)&WmipISChunkInfo);
v26 = v25;
if( !v25 )
break;
*(_DWORD *)(v25 + 16) |= 8u;
*(_QWORD *)(v25 + 56) = WmiRegGuid;
*(_QWORD *)(v25 + 64) = v5;
v17 = WmipBuildInstanceSet((__int64)WmiRegGuid, (__int64)a2, v6, v25, *(_DWORD *)(v5 + 56));
v27 = *(_QWORD *)&WmiRegGuid->Guid.Data1 - WmipBinaryMofGuid;
if( *(_QWORD *)&WmiRegGuid->Guid.Data1 == WmipBinaryMofGuid )
v27 = *(_QWORD *)WmiRegGuid->Guid.Data4 - 0x102906C9A000F0B2i64;
v28 = v39;
v29 = v27 == 0;
v30 = (_QWORD *)(v5 + 40);
v31 = *(_QWORD *)(v5 + 40);
if( v29 )
v28 = v26;
v32 = (_QWORD *)(v26 + 40);
v39 = v28;
if( *(_QWORD **)(v31 + 8) != v30 )
LABEL_61:
__fastfail(3u);
*v32 = v31;
v32[1] = v30;
*(_QWORD *)(v31 + 8) = v32;
*v30 = v32;
if( v17 < 0 )
goto LABEL_47;
v6 = v43;
LABEL_9:
++v12;
++WmiRegGuid;
if( v12 >= a2->GuidCount )
goto LABEL_10;
}
v17 = -1073741670;
LABEL_47:
v16 = v42;
LABEL_28:
if( v5 && v16 )
{
*(_DWORD *)(v5 + 16) |= 1u;
WmipUnreferenceEntry((__int64)&WmipDSChunkInfo, (volatile signed __int64 *)v5);
}
return(unsigned int)v17;
}Referenced by:
WmipInitializeDataStructs
WmipProcessWmiRegInfo