PiProcessDriverInstance

NTSTATUS __fastcall PiProcessDriverInstance(
        _UNICODE_STRING *DeviceInstanceName,
        _UNICODE_STRING *ServiceKeyName,
        CHAR *a3){
  int DevInstMatch; 
  VOID *v6; 
  _OBJECT_TYPE *v7; 
  wchar_t *Buffer; 
  CHAR v9; 
  wchar_t *v10; 
  VOID **v11; 
  unsigned __int64 Length; 
  unsigned __int64 v13; 
  VOID **PoolWithTag; 
  signed __int64 v15; 
  INT64 v17; 
  bool v18; 
  UINT64 v19; 
  INT64 CreateEnum; 
  UINT64 pszFormat; 
  UINT64 pszFormata; 
  UINT64 pszFormatb; 
  INT64 v24; 
  INT64 v25; 
  UINT64 Count; 
  _UNICODE_STRING ValueName; 
  UINT64 MatchingInstance; 
  VOID *ServiceEnumHandle; 
  _UNICODE_STRING MatchingValueName; 
  __int16 pszDest[12]; 

  LODWORD(Count) = 0;
  LODWORD(MatchingInstance) = 0;
  ServiceEnumHandle = 0i64;
  MatchingValueName = 0i64;
  ValueName = 0i64;
  DevInstMatch = PipOpenServiceEnumKeys(ServiceKeyName, 0xF003Fui64, 0i64, &ServiceEnumHandle, 1u);
  if( DevInstMatch >= 0 )
  {
    v6 = ServiceEnumHandle;
    DevInstMatch = PiFindDevInstMatch(
                     ServiceEnumHandle,
                     DeviceInstanceName,
                     &Count,
                     &MatchingValueName,
                     &MatchingInstance);
    if( DevInstMatch < 0 )
    {
LABEL_17:
      ZwClose((_HANDLE)v6);
      return DevInstMatch;
    }
    Buffer = MatchingValueName.Buffer;
    v9 = *a3;
    if( MatchingValueName.Buffer )
    {
      if( v9 )
      {
LABEL_14:
        if( Buffer )
          RtlFreeAnsiString(&MatchingValueName);
        goto LABEL_16;
      }
      ZwDeleteValueKey(v6, &MatchingValueName, v7);
      v18 = (_DWORD)Count == 1;
      v19 = (unsigned int)(Count - 1);
      LODWORD(Count) = Count - 1;
      if( !v18 )
        PiRearrangeDeviceInstances(v6, v19, (unsigned int)MatchingInstance, v17, CreateEnum, pszFormat, v24, v25);
    }
    else
    {
      if( !v9 )
      {
LABEL_16:
        DevInstMatch = 0;
        goto LABEL_17;
      }
      v10 = DeviceInstanceName->Buffer;
      v11 = 0i64;
      Length = DeviceInstanceName->Length;
      v13 = Length >> 1;
      if( v10[(Length >> 1) - 1] )
      {
        PoolWithTag = ExAllocatePoolWithTag(
                        (unsigned int)(LODWORD(MatchingValueName.Buffer) + 1),
                        Length + 2,
                        538996816i64);
        v11 = PoolWithTag;
        if( PoolWithTag )
        {
          memmove(PoolWithTag, v10, Length);
          LODWORD(Length) = Length + 2;
          *((_WORD *)v11 + v13) = 0;
          v10 = (wchar_t *)v11;
        }
      }
      ServiceEnumHandle = pszDest;
      RtlStringCchPrintfExW((WCHAR *)pszDest, 0xAui64, (WCHAR **)&ServiceEnumHandle, 0i64, 0i64, (WCHAR *)L"%u");
      v15 = ((_BYTE *)ServiceEnumHandle - (_BYTE *)pszDest) >> 1;
      ValueName.MaximumLength = 20;
      if( (_DWORD)v15 == -1 )
        ValueName.Length = 20;
      else
        ValueName.Length = 2 * v15;
      LODWORD(pszFormata) = Length;
      ValueName.Buffer = (wchar_t *)pszDest;
      ZwSetValueKey(v6, &ValueName, 0i64, 1ui64, v10, pszFormata);
      if( v11 )
        ExFreePoolWithTag(v11, 0);
      LODWORD(Count) = Count + 1;
    }
    *(_DWORD *)&ValueName.Length = 786442;
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm8;
    LODWORD(pszFormat) = 4;
    ZwSetValueKey(v6, &ValueName, 0i64, 4ui64, &Count, pszFormat);
    LODWORD(pszFormatb) = 4;
    ValueName.Buffer = (wchar_t *)&stru_1407D01E0._Xmm15;
    *(_DWORD *)&ValueName.Length = 1703960;
    ZwSetValueKey(v6, &ValueName, 0i64, 4ui64, &Count, pszFormatb);
    Buffer = MatchingValueName.Buffer;
    goto LABEL_14;
  }
  return DevInstMatch;
}

Referenced by: