CmpInitializeDriverStores

INT64 __fastcall CmpInitializeDriverStores(INT64 a1, INT64 a2, _WCHAR a3){
  NTSTATUS v4; 
  VOID **PoolWithTag; 
  wchar_t *v6; 
  __int64 **v7; 
  __int64 *v8; 
  _WCHAR *SystemRelativeRegistryHiveFilePath; 
  unsigned __int64 v11; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING DestinationString; 
  _STRING SourceString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *LinkHandle; 
  VOID *DirectoryHandle; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LinkHandle = 0i64;
  DirectoryHandle = 0i64;
  Destination = 0i64;
  SourceString = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\DriverStores");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 592;
  v4 = ZwCreateDirectoryObject(&DirectoryHandle, 983055, &ObjectAttributes);
  if( v4 >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 538987843i64);
    v6 = (wchar_t *)PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, 0x1000u);
      Destination.MaximumLength = 4096;
      Destination.Buffer = v6;
      RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\SystemRoot");
      RtlInitUnicodeString(&DestinationString, (PCWSTR)L"SYSTEM");
      ObjectAttributes.SecurityQualityOfService = 0i64;
      ObjectAttributes.RootDirectory = DirectoryHandle;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
      Destination.MaximumLength = Destination.Length;
      ObjectAttributes.Attributes = 592;
      v4 = ZwCreateSymbolicLinkObject(&LinkHandle, 983041, &ObjectAttributes, &Destination);
      if( v4 >= 0 )
      {
        ZwClose((_HANDLE)LinkHandle);
        v7 = (__int64 **)(*(_QWORD *)(a1 + 240) + 312i64);
        v8 = *v7;
        while( v8 != (__int64 *)v7 )
        {
          if( (*((_DWORD *)v8 + 6) & 0x80u) != 0 )
          {
            RtlInitAnsiString(&SourceString, (PCSZ)v8[11]);
            v4 = RtlAnsiStringToUnicodeString(&DestinationString, &SourceString, 1u);
            if( v4 < 0 )
              break;
            *(_QWORD *)&Destination.Length = 0x10000000i64;
            Destination.Buffer = v6;
            RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\ArcName\\");
            RtlAppendUnicodeStringToString(&Destination, &DestinationString);
            RtlFreeAnsiString(&DestinationString);
            SystemRelativeRegistryHiveFilePath = CmpGetSystemRelativeRegistryHiveFilePath((_WCHAR *)v8[2]);
            v11 = v8[2];
            if( (unsigned __int64)SystemRelativeRegistryHiveFilePath > v11
              && (__int64)(((unsigned __int64)SystemRelativeRegistryHiveFilePath - v11) & 0xFFFFFFFFFFFFFFFEui64) < 131070 )
            {
              DestinationString.Buffer = (wchar_t *)v8[2];
              DestinationString.Length = 2
                                       * ((__int64)(unsigned int)((_DWORD)SystemRelativeRegistryHiveFilePath
                                                                - *((_DWORD *)v8 + 4)) >> 1);
              DestinationString.MaximumLength = DestinationString.Length;
              RtlAppendUnicodeStringToString(&Destination, &DestinationString);
            }
            RtlInitUnicodeString(&DestinationString, (PCWSTR)v8[6]);
            ObjectAttributes.SecurityQualityOfService = 0i64;
            ObjectAttributes.RootDirectory = DirectoryHandle;
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = &DestinationString;
            ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
            Destination.MaximumLength = Destination.Length;
            ObjectAttributes.Attributes = 592;
            v4 = ZwCreateSymbolicLinkObject(&LinkHandle, 983041, &ObjectAttributes, &Destination);
            if( v4 < 0 )
              break;
            ZwClose((_HANDLE)LinkHandle);
          }
          v8 = (__int64 *)*v8;
          v7 = (__int64 **)(*(_QWORD *)(a1 + 240) + 312i64);
        }
      }
      ExFreePoolWithTag(v6, 0);
    }
    else
    {
      v4 = -1073741670;
    }
  }
  if( DirectoryHandle )
    ZwClose((_HANDLE)DirectoryHandle);
  return(unsigned int)v4;
}

Referenced by: