PnpDriverLoadingFailed

NTSTATUS __fastcall PnpDriverLoadingFailed(VOID *Handle, _UNICODE_STRING *ServiceKeyName, __int64 a3, INT64 a4){
  int v4; 
  VOID *v6; 
  NTSTATUS result; 
  unsigned int v8; 
  NTSTATUS RegistryValue; 
  unsigned int v10; 
  _ADAPTER_OBJECT *v11; 
  _ADAPTER_OBJECT *v12; 
  __int64 v13; 
  PDEVICE_NODE v14; 
  _ETHREAD *CurrentThread; 
  __int64 v16; 
  int v17; 
  _ETHREAD *v18; 
  int v19; 
  unsigned int i; 
  __int64 v21; 
  _OBJECT_TYPE *v22; 
  _KEY_VALUE_FULL_INFORMATION *v23; 
  __int64 v24; 
  INT64 CreateEnum; 
  VOID **CreateEnuma; 
  UINT64 DataSize; 
  UINT64 DataSizea; 
  UINT64 DataSizeb; 
  UINT64 DataSizec; 
  INT64 v31; 
  INT64 v32; 
  _UNICODE_STRING ValueName; 
  VOID *KeyHandle; 
  unsigned int v35; 
  int v36; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  VOID *ServiceHandle; 
  int Data; 
  _NTSTRSAFE_PWSTR ppszDestEnd[2]; 
  _NTSTRSAFE_PWSTR v41[2]; 
  _UNICODE_STRING DeviceInstanceRegistryPath; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 pszDest[20]; 

  Information = 0i64;
  v4 = 0;
  KeyHandle = 0i64;
  *(_DWORD *)(&ValueName.MaximumLength + 1) = 0;
  ServiceHandle = Handle;
  v6 = Handle;
  v36 = 0;
  DeviceInstanceRegistryPath = 0i64;
  if( Handle )
  {
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm7;
    ObjectAttributes.RootDirectory = Handle;
    ObjectAttributes.ObjectName = &ValueName;
    *(_DWORD *)&ValueName.Length = 655368;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    result = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, a4, CreateEnum, DataSize, v31, v32);
  }
  else
  {
    result = PipOpenServiceEnumKeys(ServiceKeyName, 0x20019ui64, &ServiceHandle, &KeyHandle, 0);
    v6 = ServiceHandle;
    v4 = 1;
    v36 = 1;
  }
  if( result >= 0 )
  {
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm13;
    *(_DWORD *)&ValueName.Length = 2097182;
    LODWORD(DataSize) = 4;
    Data = 1;
    ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &Data, DataSize);
    v8 = 0;
    RegistryValue = IopGetRegistryValue(KeyHandle, (PWCHAR)&stru_1407D01E0._Xmm8, 0i64, &Information);
    if( RegistryValue < 0 )
      goto LABEL_44;
    if( Information->Type == 4 && Information->DataLength >= 4 )
      v8 = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset);
    ExFreePoolWithTag(Information, 0);
    if( v8 )
    {
      v10 = 0;
      v35 = v8;
      do
      {
        if( PipServiceInstanceToDeviceInstance(
               v6,
               ServiceKeyName,
               v10,
               &DeviceInstanceRegistryPath,
               CreateEnuma,
               DataSizea) >= 0 )
        {
          v11 = (_ADAPTER_OBJECT *)PnpDeviceObjectFromDeviceInstanceWithTag(
                                     (__int64)&DeviceInstanceRegistryPath,
                                     0x746C6644u);
          v12 = v11;
          if( v11 )
          {
            v13 = *(_QWORD *)(v11->ExpiredLock._bf_0 + 40);
            if( v13 )
            {
              if( !PipIsDevNodeDNStarted(v13) )
                IopReleaseDeviceResources(v14, 1u);
            }
          }
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          --CurrentThread->Tcb.KernelApcDisable;
          ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 6688, 1);
          if( v12 )
          {
            v16 = *(_QWORD *)(v12->ExpiredLock._bf_0 + 40);
            if( v16 && (*(_DWORD *)(v16 + 396) & 1) != 0 && (unsigned int)(*(_DWORD *)(v16 + 300) - 775) <= 1 )
            {
              PoFxAbandonDevice((_DEVICE_NODE *)v16);
              PipSetDevNodeState((_DEVICE_NODE *)v16, DeviceNodeRemoved);
              PipSetDevNodeProblem((_DEVICE_NODE *)v16, 0x18ui64, 0);
            }
            HalPutDmaAdapter(v12);
          }
          ExFreePoolWithTag(DeviceInstanceRegistryPath.Buffer, 0);
          ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          v6 = ServiceHandle;
        }
        ++v10;
      }
      while( v10 < v8 );
      v17 = v36;
      if( v35 != v8 )
      {
        v18 = (_ETHREAD *)KeGetCurrentThread();
        --v18->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 6688, 1);
        if( v35 )
        {
          v19 = 0;
          for( i = 0; i < v8; ++i )
          {
            *(_QWORD *)ppszDestEnd = pszDest;
            RtlStringCchPrintfExW((WCHAR *)pszDest, 0xAui64, (WCHAR **)ppszDestEnd, 0i64, 0i64, (WCHAR *)L"%u");
            ValueName.MaximumLength = 20;
            v21 = (__int64)(*(_QWORD *)ppszDestEnd - (_QWORD)pszDest) >> 1;
            if( (_DWORD)v21 == -1 )
              ValueName.Length = 20;
            else
              ValueName.Length = 2 * v21;
            ValueName.Buffer = (wchar_t *)pszDest;
            if( IopGetRegistryValue(KeyHandle, (PWCHAR)pszDest, 0i64, &Information) >= 0 )
            {
              v23 = Information;
              if( i != v19 )
              {
                ZwDeleteValueKey(KeyHandle, &ValueName, v22);
                *(_QWORD *)v41 = pszDest;
                RtlStringCchPrintfExW((WCHAR *)pszDest, 0xAui64, (WCHAR **)v41, 0i64, 0i64, (WCHAR *)L"%u");
                ValueName.MaximumLength = 20;
                v24 = (__int64)(*(_QWORD *)v41 - (_QWORD)pszDest) >> 1;
                if( (_DWORD)v24 == -1 )
                  ValueName.Length = 20;
                else
                  ValueName.Length = 2 * v24;
                ValueName.Buffer = (wchar_t *)pszDest;
                LODWORD(DataSizeb) = v23->DataLength;
                ZwSetValueKey(KeyHandle, &ValueName, 0i64, 1ui64, (char *)v23 + v23->DataOffset, DataSizeb);
              }
              ExFreePoolWithTag(v23, 0);
              ++v19;
            }
          }
          v17 = v36;
        }
        ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm8;
        *(_DWORD *)&ValueName.Length = 786442;
        LODWORD(DataSizea) = 4;
        ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &v35, DataSizea);
        ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm15;
        LODWORD(DataSizec) = 4;
        *(_DWORD *)&ValueName.Length = 1703960;
        ZwSetValueKey(KeyHandle, &ValueName, 0i64, 4ui64, &v35, DataSizec);
        ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        LODWORD(v6) = (_DWORD)ServiceHandle;
      }
      ZwClose((_HANDLE)KeyHandle);
      if( v17 )
        ZwClose((_HANDLE)v6);
      return 0;
    }
    else
    {
LABEL_44:
      ZwClose((_HANDLE)KeyHandle);
      if( v4 )
        ZwClose((_HANDLE)v6);
      return RegistryValue;
    }
  }
  return result;
}

Referenced by: