PiCMEnumerateSubKeys

NTSTATUS __stdcall PiCMEnumerateSubKeys(
        VOID *IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        VOID *IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  UINT64 *v5; 
  unsigned int v6; 
  VOID **PoolWithTag; 
  int v9; 
  UINT64 v10; 
  NTSTATUS v11; 
  unsigned int v13; 
  PNPCTX_BASE_KEY_TYPE v14; 
  NTSTATUS CachedContextBaseKey; 
  unsigned int v16; 
  unsigned int v17; 
  int v18; 
  NTSTATUS v19; 
  UINT64 v20; 
  UINT64 ExpectedOutputSize; 
  VOID *IoctlOutputBuffera; 
  VOID *IoctlOutputBufferb; 
  UINT64 IoctlOutputBufferSizea; 
  INT64 v25; 
  UINT64 KeyIndex[2]; 
  UINT64 v27; 
  UINT64 *BytesUseda; 

  v5 = BytesUseda;
  v25 = 0i64;
  v6 = IoctlOutputBufferSize;
  LODWORD(BytesUsed) = 0;
  LODWORD(BytesUseda) = 0;
  *(_DWORD *)v5 = 0;
  *(_OWORD *)KeyIndex = 0i64;
  LODWORD(v27) = 0;
  PoolWithTag = 0i64;
  v9 = PiCMCaptureEnumerateInputData(
         IoctlInputBuffer,
         IoctlInputBufferSize,
         (_CMAPI_INPUT_ENUMERATE_DATA *)IoctlOutputBuffer);
  if( v9 < 0 )
    return v9;
  if( HIDWORD(KeyIndex[0]) )
    goto LABEL_3;
  if( !IoctlOutputBuffer || v6 < 0x14 )
  {
    v10 = 3221225485i64;
    goto LABEL_29;
  }
  v13 = v6 - 20;
  if( v6 - 20 < 2 )
    goto LABEL_3;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v13, 879783504i64);
  if( !PoolWithTag )
  {
    v10 = 3221225626i64;
    goto LABEL_4;
  }
  LODWORD(BytesUsed) = v13 >> 1;
  if( LODWORD(KeyIndex[1]) == 1 )
  {
    v14 = PNPCTX_BASE_KEY_TYPE_ENUM;
    goto LABEL_19;
  }
  if( LODWORD(KeyIndex[1]) == 2 )
  {
    v14 = PNPCTX_BASE_KEY_TYPE_CLASS;
    goto LABEL_19;
  }
  if( LODWORD(KeyIndex[1]) != 3 )
  {
LABEL_3:
    v10 = 3221225485i64;
LABEL_4:
    LODWORD(IoctlOutputBufferSizea) = v6;
    LODWORD(ExpectedOutputSize) = v27;
    LODWORD(v20) = 0;
    v11 = PiCMReturnBufferResultData(
            v10,
            (unsigned int)(2 * (_DWORD)BytesUsed),
            0i64,
            0i64,
            v20,
            ExpectedOutputSize,
            IoctlOutputBuffer,
            IoctlOutputBufferSizea,
            v5);
    goto LABEL_5;
  }
  v14 = PNPCTX_BASE_KEY_TYPE_DEVICECLASSES;
LABEL_19:
  CachedContextBaseKey = PnpCtxGetCachedContextBaseKey(*(&stru_140CF2E80 + 607), v14, (VOID **)&v25);
  v10 = (unsigned int)CachedContextBaseKey;
  if( CachedContextBaseKey < 0 )
    goto LABEL_4;
  v16 = HIDWORD(KeyIndex[1]);
  v17 = RegRtlEnumKey(
          (VOID *)v25,
          HIDWORD(KeyIndex[1]),
          (WCHAR *)PoolWithTag,
          (UINT64 *)&BytesUsed,
          v20,
          ExpectedOutputSize,
          (INT64)IoctlOutputBuffera,
          IoctlOutputBufferSizea);
  v10 = v17;
  if( v17 == -2147483622 )
  {
    if( LODWORD(KeyIndex[1]) != 3 )
      goto LABEL_4;
    if( !CmIsStateSeparationEnabled() )
      goto LABEL_4;
    v18 = PnpCtxRegQueryInfoKey(v10, (VOID *)v25, &BytesUseda, 0i64, 0i64, 0i64, 0i64);
    v10 = (unsigned int)v18;
    if( v18 < 0 )
      goto LABEL_4;
    if( v16 < (unsigned int)BytesUseda )
    {
      v10 = 3221225701i64;
      goto LABEL_4;
    }
    v19 = PnpCtxGetCachedContextBaseKey(*(&stru_140CF2E80 + 607), PNPCTX_BASE_KEY_TYPE_DEVICECONTAINERS, (VOID **)&v25);
    v10 = (unsigned int)v19;
    if( v19 < 0 )
      goto LABEL_4;
    v10 = (unsigned int)RegRtlEnumKey(
                          (VOID *)v25,
                          v16 - (unsigned int)BytesUseda,
                          (WCHAR *)PoolWithTag,
                          (UINT64 *)&BytesUsed,
                          v20,
                          ExpectedOutputSize,
                          (INT64)IoctlOutputBufferb,
                          IoctlOutputBufferSizea);
  }
LABEL_29:
  if( (v10 & 0x80000000) != 0i64 )
    goto LABEL_4;
  LODWORD(IoctlOutputBufferSizea) = v6;
  LODWORD(ExpectedOutputSize) = v27;
  LODWORD(v20) = 2 * (_DWORD)BytesUsed;
  v11 = PiCMReturnBufferResultData(
          v10,
          (unsigned int)(2 * (_DWORD)BytesUsed),
          0i64,
          PoolWithTag,
          v20,
          ExpectedOutputSize,
          IoctlOutputBuffer,
          IoctlOutputBufferSizea,
          v5);
LABEL_5:
  v9 = v11;
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x34706E50u);
  return v9;
}

Referenced by: