SbpAddTransportToInstance

NTSTATUS __stdcall SbpAddTransportToInstance(){
  VOID **v0; 
  NTSTATUS DeviceObjectPointer; 
  PFILE_OBJECT v2; 
  NTSTATUS Status; 
  VOID **PoolWithTag; 
  _DEVICE_OBJECT *v5; 
  _IRP *v6; 
  UINT64 v7; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  PDEVICE_OBJECT v9; 
  UINT64 OutputBufferLength; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 Object; 
  __int64 v14; 
  VOID *ReturnAddress; 
  PDEVICE_OBJECT DeviceObject; 
  PFILE_OBJECT FileObject; 

  FileObject = 0i64;
  v14 = 0i64;
  DeviceObject = 0i64;
  Object = 0i64;
  v0 = 0i64;
  IoStatusBlock = 0i64;
  DeviceObjectPointer = IoGetDeviceObjectPointer(
                          (_UNICODE_STRING *)&InstanceName,
                          0x10000000ui64,
                          &FileObject,
                          &DeviceObject);
  v2 = FileObject;
  Status = DeviceObjectPointer;
  if( DeviceObjectPointer >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0xD0ui64, 1113746771i64);
    v0 = PoolWithTag;
    if( !PoolWithTag )
      goto LABEL_3;
    memset((char *)PoolWithTag + 12, 0i64, 0xC4u);
    *(_DWORD *)v0 = 16;
    *((_DWORD *)v0 + 1) = 2;
    *((_DWORD *)v0 + 2) = 192;
    *(_OWORD *)((char *)v0 + 12) = *(_OWORD *)L"\\Device\\VMBus\\{4d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d0"
                                               "7-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 28) = *(_OWORD *)L"VMBus\\{4d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 44) = *(_OWORD *)L"d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 60) = *(_OWORD *)L"17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 76) = *(_OWORD *)L"4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 92) = *(_OWORD *)L"270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 108) = *(_OWORD *)L"db7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000";
    v5 = DeviceObject;
    *(_OWORD *)((char *)v0 + 124) = *(_OWORD *)L"c079ae-60ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 140) = *(_OWORD *)L"0ba-4d07-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 156) = *(_OWORD *)L"-847c-3493609c0870}-0000";
    *(_OWORD *)((char *)v0 + 172) = *(_OWORD *)L"93609c0870}-0000";
    *(_OWORD *)((char *)v0 + 188) = *(_OWORD *)L"70}-0000";
    v14 = (__int64)&Object + 8;
    LOWORD(Object) = 1;
    *((_QWORD *)&Object + 1) = (char *)&Object + 8;
    LODWORD(OutputBufferLength) = 0;
    BYTE2(Object) = 6;
    DWORD1(Object) = 0;
    v6 = IopBuildDeviceIoControlRequest(
           0x1401B0ui64,
           v5,
           v0,
           0xD0ui64,
           0i64,
           OutputBufferLength,
           0,
           (_KEVENT *)&Object,
           &IoStatusBlock,
           ReturnAddress);
    v7 = (UINT64)v6;
    if( v6 )
    {
      CurrentStackLocation = v6->Tail.CurrentStackLocation;
      v9 = DeviceObject;
      CurrentStackLocation[-1].FileObject = v2;
      CurrentStackLocation[-1].MajorFunction = 13;
      Status = IofCallDriver((UINT64)v9, v7);
      if( Status == 259 )
      {
        KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
        Status = IoStatusBlock.Status;
      }
    }
    else
    {
LABEL_3:
      Status = -1073741670;
    }
  }
  if( v2 )
    ObfDereferenceObjectWithTag(v2, 0x746C6644ui64);
  if( v0 )
    ExFreeHeapPool(v0);
  return Status;
}

Referenced by: