PiUEventHandleRegistration

NTSTATUS __stdcall PiUEventHandleRegistration(
        _FILE_OBJECT *FileObject,
        VOID *Buffer,
        UINT64 InputBufferLength,
        UINT64 OutputBufferLength,
        _IO_STATUS_BLOCK *IoStatus){
  _WNF_STATE_NAME *inited; 
  CHAR v6; 
  int v9; 
  int v10; 
  int v11; 
  VOID **v12; 
  UINT64 v13; 
  int v14; 
  int v15; 
  unsigned int v16; 
  char *v17; 
  _WNF_STATE_NAME **v18; 
  int v20; 
  int v21; 
  unsigned int v22; 
  char *v23; 
  _WNF_STATE_NAME **v24; 
  int v25; 
  int v26; 
  unsigned int v27; 
  char *v28; 
  _WNF_STATE_NAME **v29; 
  NTSTATUS Object; 
  unsigned int v31; 
  char *v32; 
  _WNF_STATE_NAME **v33; 
  _UNICODE_STRING *DeviceId; 
  _DEVICE_OBJECT *RevocationDeviceObject; 
  UINT64 pcchLength; 

  DeviceId = 0i64;
  inited = 0i64;
  RevocationDeviceObject = 0i64;
  v6 = 0;
  if( !Buffer || (_DWORD)InputBufferLength != 936 || (_DWORD)OutputBufferLength != 8 )
  {
    v9 = -1073741811;
    goto LABEL_25;
  }
  inited = PiUEventInitClientRegistrationContext();
  if( !inited )
  {
    v9 = -1073741670;
LABEL_55:
    FileObject->FsContext2 = 0i64;
    return v9;
  }
  inited[6] = (_WNF_STATE_NAME)PsGetCurrentThreadProcessId();
  SeCaptureSubjectContext((INT64)&inited[7]);
  v9 = RtlStringCchLengthW((WCHAR *)Buffer, 0x104ui64, &pcchLength);
  if( v9 < 0 )
    goto LABEL_52;
  if( *((_DWORD *)Buffer + 130) != 416 )
    goto LABEL_52;
  v10 = *((_DWORD *)Buffer + 132);
  if( v10 >= 4 )
    goto LABEL_52;
  v11 = *((_DWORD *)Buffer + 131);
  if( (v11 & 0xFFFFFFFC) != 0 || (v11 & 1) != 0 && v10 )
    goto LABEL_52;
  if( (v11 & 2) != 0 && (unsigned int)(v10 - 2) > 1 )
    goto LABEL_52;
  v12 = (VOID **)((char *)Buffer + 536);
  if( v10 == 1 && (((unsigned __int64)*v12 + 1) & 0xFFFFFFFFFFFFFFFEui64) == 0 )
    goto LABEL_52;
  v13 = 200i64;
  if( v10 == 2 )
  {
    v9 = RtlStringCchLengthW((WCHAR *)Buffer + 268, 0xC8ui64, &pcchLength);
    if( v9 < 0 )
      goto LABEL_52;
  }
  if( *((_DWORD *)Buffer + 132) == 3 )
  {
    v9 = RtlStringCchLengthW((WCHAR *)Buffer + 268, v13, &pcchLength);
    if( v9 < 0 )
      goto LABEL_52;
  }
  inited[16].Data[1] = *((_DWORD *)Buffer + 132);
  v14 = *((_DWORD *)Buffer + 132);
  if( v14 )
  {
    v20 = v14 - 1;
    if( v20 )
    {
      v25 = v20 - 1;
      if( !v25 || v25 == 1 )
      {
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          goto LABEL_17;
        Object = PiDmGetObject(1, (WCHAR *)Buffer + 268, (PI_DM_OBJECT **)&inited[3]);
        v9 = Object;
        if( Object >= 0 )
          goto LABEL_17;
LABEL_53:
        if( inited )
          PiUEventFreeClientRegistrationContext(inited, v6);
        goto LABEL_55;
      }
    }
    else if( PiUEventGetDeviceInstanceIdFromUserHandle(*v12, &DeviceId, &RevocationDeviceObject) >= 0 )
    {
      v9 = PiDmGetObject(1, DeviceId->Buffer, (PI_DM_OBJECT **)&inited[3]);
      if( v9 >= 0 )
      {
        inited[4] = (_WNF_STATE_NAME)RevocationDeviceObject;
        LOBYTE(inited[5].Data[0]) = 0;
        goto LABEL_17;
      }
      goto LABEL_53;
    }
LABEL_52:
    v9 = -1073741811;
    goto LABEL_53;
  }
  if( (*((_DWORD *)Buffer + 131) & 1) == 0 )
    *(_OWORD *)inited[3].Data = *(_OWORD *)v12;
LABEL_17:
  *(_WNF_STATE_NAME *)Buffer = inited[11];
  IoStatus->Information = 8i64;
  ExAcquireFastMutex((PFAST_MUTEX)((char *)&PnpReplaceEvent + 7040));
  v15 = *((_DWORD *)Buffer + 132);
  if( v15 )
  {
    v21 = v15 - 1;
    if( v21 )
    {
      v26 = v21 - 1;
      if( v26 )
      {
        if( v26 != 1 )
        {
          v9 = -1073741811;
          goto LABEL_23;
        }
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          v31 = 13;
        else
          PiUEventHashStringIntoBucket((const WCHAR *)Buffer + 268);
        v32 = (char *)&PnpReplaceEvent + 16 * v31 + 7552;
        v33 = (_WNF_STATE_NAME **)*((_QWORD *)v32 + 1);
        if( *v33 == (_WNF_STATE_NAME *)v32 )
        {
          ++*(&stru_140CF2E80 + 1630);
          *inited = (_WNF_STATE_NAME)v32;
          inited[1] = (_WNF_STATE_NAME)v33;
          *v33 = inited;
          *((_QWORD *)v32 + 1) = inited;
          goto LABEL_22;
        }
      }
      else
      {
        if( (*((_DWORD *)Buffer + 131) & 2) != 0 )
          v27 = 13;
        else
          PiUEventHashStringIntoBucket((const WCHAR *)Buffer + 268);
        v28 = (char *)&PnpReplaceEvent + 16 * v27 + 7104;
        v29 = (_WNF_STATE_NAME **)*((_QWORD *)v28 + 1);
        if( *v29 == (_WNF_STATE_NAME *)v28 )
        {
          ++PiUEventDevInstanceClientCount;
          *inited = (_WNF_STATE_NAME)v28;
          inited[1] = (_WNF_STATE_NAME)v29;
          *v29 = inited;
          *((_QWORD *)v28 + 1) = inited;
          goto LABEL_22;
        }
      }
    }
    else
    {
      PiUEventHashStringIntoBucket(*(const WCHAR **)(*(_QWORD *)&inited[3] + 16i64));
      v23 = (char *)&PnpReplaceEvent + 16 * v22 + 7328;
      v24 = (_WNF_STATE_NAME **)*((_QWORD *)v23 + 1);
      if( *v24 == (_WNF_STATE_NAME *)v23 )
      {
        ++PiUEventDevHandleClientCount;
        *inited = (_WNF_STATE_NAME)v23;
        inited[1] = (_WNF_STATE_NAME)v24;
        *v24 = inited;
        *((_QWORD *)v23 + 1) = inited;
        goto LABEL_22;
      }
    }
LABEL_70:
    __fastfail(3u);
  }
  if( (*((_DWORD *)Buffer + 131) & 1) != 0 )
    v16 = 13;
  else
    v16 = PiUEventHashGuidIntoBucket((_GUID *)((char *)Buffer + 536));
  v17 = (char *)&PnpReplaceEvent + 16 * v16 + 6816;
  v18 = (_WNF_STATE_NAME **)*((_QWORD *)v17 + 1);
  if( *v18 != (_WNF_STATE_NAME *)v17 )
    goto LABEL_70;
  ++PiUEventDevInterfaceClientCount;
  *inited = (_WNF_STATE_NAME)v17;
  inited[1] = (_WNF_STATE_NAME)v18;
  *v18 = inited;
  *((_QWORD *)v17 + 1) = inited;
LABEL_22:
  v6 = 1;
LABEL_23:
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 7040));
  if( v9 < 0 )
    goto LABEL_53;
  FileObject->FsContext2 = inited;
LABEL_25:
  if( v9 < 0 )
    goto LABEL_53;
  return v9;
}

Referenced by: