/* This file has been generated by the Hex-Rays decompiler.
   Copyright (c) 2009 Hex-Rays <info@hex-rays.com>

   Detected compiler: Visual C++
*/

#include <windows.h>
#include <defs.h>


//-------------------------------------------------------------------------
// Data declarations

extern char Format[]; // idb
extern const WCHAR aItermi[]; // idb
extern const WCHAR aI_0[]; // idb
extern const WCHAR aIquery[]; // idb
extern const WCHAR aI[]; // idb
extern const WCHAR word_11C3A; // idb
extern const WCHAR SourceString[]; // idb
extern wchar_t aRegistryMachin[41]; // weak
extern const WCHAR a0[]; // idb
extern char aSystem[]; // idb
extern char aDriverMde2Pass[]; // idb
extern char aLeft4dead2_exe[15]; // weak
extern char aDriverMde1Pass[22]; // weak
extern char aHl2_exe[8]; // weak
extern char aDriverMde2Acti[]; // idb
extern char aDriverMde1Acti[22]; // weak
extern char aSmplxclntxxxx[]; // idb
extern char aExplorer_exe[13]; // weak
extern int dword_11D4C[3]; // weak
extern __int16 word_11D5A; // weak
extern int dword_11D64[3]; // weak
extern char aErrorGettinFun[]; // idb
extern char aHked[5]; // weak
extern char aUnhked[]; // idb
// extern void *KeServiceDescriptorTable; weak
// extern volatile KSYSTEM_TIME KeTickCount;
extern int dword_13004; // weak
extern int dword_13008; // weak
extern PVOID BaseAddress; // idb
extern PMDL MemoryDescriptorList; // idb
extern int dword_13014; // weak
extern int dword_13018; // weak
extern int dword_1301C; // weak
extern int dword_13024; // weak
extern int (__stdcall *dword_13028)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // weak
extern int dword_1302C; // weak
extern int dword_13030; // weak
extern int dword_13034; // weak
extern int (__stdcall *dword_13038)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // weak
extern int (__stdcall *dword_1303C)(_DWORD, _DWORD); // weak
extern int (__stdcall *dword_13040)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // weak
extern int dword_13044; // weak
extern char byte_13051; // weak

//-------------------------------------------------------------------------
// Function declarations

int __stdcall sub_11006(int); // weak
int __stdcall sub_11024(int a1, int a2);
signed int __cdecl sub_1105A();
signed int __cdecl sub_110BA();
int __stdcall sub_110EA(int a1, int a2);
NTSTATUS __cdecl sub_11116();
NTSTATUS __cdecl sub_114D-----------------
signed int __cdecl sub_1105A()
{
  struct _MDL *v0; // eax@1
  signed int result; // eax@2

  v0 = MmCreateMdl(0, KeServiceDescriptorTable, 4 * (_DWORD)*(&KeServiceDescriptorTable + 2));
  MemoryDescriptorList = v0;
  if ( v0 )
  {
    MmBuildMdlForNonPagedPool(v0);
    MemoryDescriptorList->MdlFlags |= 1u;
    BaseAddress = MmMapLockedPages(MemoryDescriptorList, 0);
    dword_13014 = 1;
    result = 1;
  }
  else
  {
    result = -1;
    dword_13014 = -1;
  }
  return result;
}
// 12004: using guessed type void *KeServiceDescriptorTable;
// 13014: using guessed type int dword_13014;

//----- (000110BA) --------------------------------------------------------
signed int __cdecl sub_110BA()
{
  if ( dword_13014 )
  {
    MmUnmapLockedPages(BaseAddress, MemoryDescriptorList);
    IoFreeMdl(MemoryDescriptorList);
  }
  return 1;
}
// 13014: using guessed type int dword_13014;

//----- (000110EA) --------------------------------------------------------
int __stdcall sub_110EA(int a1, int a2)
{
  int result; // eax@2
  char *v3; // ecx@3

  if ( dword_13014 )
  {
    v3 = (char *)BaseAddress + 4 * a1;
    result = *(_DWORD *)v3;
    *(_DWORD *)v3 = a2;
  }
  else
  {
    result = 0;
  }
  return result;
}
// 13014: using guessed type int dword_13014;

//----- (00011116) --------------------------------------------------------
NTSTATUS __cdecl sub_11116()
{
  NTSTATUS result; // eax@1
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+0h] [bp-140h]@1
  __int16 v2; // [sp+18h] [bp-128h]@1
  __int16 v3; // [sp+1Ah] [bp-126h]@1
  int v4; // [sp+1Ch] [bp-124h]@1
  ULONG ResultLength; // [sp+20h] [bp-120h]@2
  UNICODE_STRING DestinationString; // [sp+24h] [bp-11Ch]@2
  HANDLE Handle; // [sp+2Ch] [bp-114h]@1
  ULONG Value; // [sp+30h] [bp-110h]@4
  const UNICODE_STRING String; // [sp+34h] [bp-10Ch]@4
  char KeyValueInformation; // [sp+3Ch] [bp-104h]@2
  int v11; // [sp+40h] [bp-100h]@3
  USHORT v12; // [sp+44h] [bp-FCh]@4
  char v13; // [sp+48h] [bp-F8h]@4
  unsigned int v14; // [sp+13Ch] [bp-4h]@1
  int v15; // [sp+140h] [bp+0h]@1

  v14 = (unsigned int)&v15 ^ dword_13004;
  v2 = 80;
  v3 = 82;
  ObjectAttributes.RootDirectory = 0;
  ObjectAttributes.SecurityDescriptor = 0;
  ObjectAttributes.SecurityQualityOfService = 0;
  v4 = (int)L"\\Registry\\Machine\\Software\\SevenSoftware";
  ObjectAttributes.Length = 24;
  ObjectAttributes.Attributes = 64;
  ObjectAttributes.ObjectName = (PUNICODE_STRING)&v2;
  result = ZwOpenKey(&Handle, 1u, &ObjectAttributes);
  if ( result >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"address");
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           256u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0x10u, &Value) >= 0 )
          dword_13024 = Value;
      }
    }
    RtlInitUnicodeString(&DestinationString, &word_11C3A);
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x100u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0x10u, &Value) >= 0 )
          dword_13034 = Value;
      }
    }
    RtlInitUnicodeString(&DestinationString, "i");
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x100u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0xAu, &Value) >= 0 )
          dword_13044 = Value;
      }
    }
    RtlInitUnicodeString(&DestinationString, L"iQuery");
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x100u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0xAu, &Value) >= 0 )
          dword_1302C = Value;
      }
    }
    RtlInitUnicodeString(&DestinationString, "i");
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x100u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0xAu, &Value) >= 0 )
          dword_13018 = Value;
      }
    }
    RtlInitUnicodeString(&DestinationString, L"iTermi");
    if ( ZwQueryValueKey(
           Handle,
           &DestinationString,
           KeyValuePartialInformation,
           &KeyValueInformation,
           0x100u,
           &ResultLength) >= 0 )
    {
      if ( v11 == 1 )
      {
        String.Length = v12;
        String.MaximumLength = v12;
        String.Buffer = (PWSTR)&v13;
        if ( RtlUnicodeStringToInteger(&String, 0xAu, &Value) >= 0 )
          dword_13030 = Value;
      }
    }
    result = ZwClose(Handle);
  }
  return result;
}
// 11C54: using guessed type wchar_t aRegistryMachin[41];
// 13004: using guessed type int dword_13004;
// 13018: using guessed type int dword_13018;
// 13024: using guessed type int dword_13024;
// 1302C: using guessed type int dword_1302C;
// 13030: using guessed type int dword_13030;
// 13034: using guessed type int dword_13034;
// 13044: using guessed type int dword_13044;

//----- (000114D6) --------------------------------------------------------
NTSTATUS __cdecl sub_114D6()
{
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+4h] [bp-3Ch]@1
  unsigned __int16 v2; // [sp+1Ch] [bp-24h]@2
  void *v3; // [sp+20h] [bp-20h]@2
  unsigned __int16 v4; // [sp+24h] [bp-1Ch]@2
  PVOID Data; // [sp+28h] [bp-18h]@2
  UNICODE_STRING DestinationString; // [sp+2Ch] [bp-14h]@2
  __int16 v7; // [sp+34h] [bp-Ch]@1
  __int16 v8; // [sp+36h] [bp-Ah]@1
  int v9; // [sp+38h] [bp-8h]@1
  HANDLE Handle; // [sp+3Ch] [bp-4h]@1

  v7 = 80;
  v8 = 82;
  ObjectAttributes.ObjectName = (PUNICODE_STRING)&v7;
  v9 = (int)L"\\Registry\\Machine\\Software\\SevenSoftware";
  ObjectAttributes.Length = 24;
  ObjectAttributes.RootDirectory = 0;
  ObjectAttributes.Attributes = 64;
  ObjectAttributes.SecurityDescriptor = 0;
  ObjectAttributes.SecurityQualityOfService = 0;
  if ( ZwOpenKey(&Handle, 1u, &ObjectAttributes) >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"address");
    RtlInitUnicodeString((PUNICODE_STRING)&v4, "0");
    ZwSetValueKey(Handle, &DestinationString, 0, 1u, Data, v4);
    RtlInitUnicodeString(&DestinationString, &word_11C3A);
    RtlInitUnicodeString((PUNICODE_STRING)&v2, "0");
    ZwSetValueKey(Handle, &DestinationString, 0, 1u, v3, v2);
  }
  return ZwClose(Handle);
}
// 11C54: using guessed type wchar_t aRegistryMachin[41];

//----- (0001159A) --------------------------------------------------------
int __cdecl sub_1159A()
{
  PEPROCESS v0; // edi@1
  signed int v1; // esi@1
  int result; // eax@2

  v0 = IoGetCurrentProcess();
  v1 = 0;
  do
  {
    result = strncmp("System", (const char *)v0 + v1, 6u);
    if ( !result )
      dword_1301C = v1;
    ++v1;
  }
  while ( v1 < 12288 );
  return result;
}
// 1301C: using guessed type int dword_1301C;

//----- (000115D8) --------------------------------------------------------
char __stdcall sub_115D8(char *a1)
{
  char result; // al@2
  PEPROCESS v2; // eax@2

  if ( dword_1301C )
  {
    v2 = IoGetCurrentProcess();
    strncpy(a1, (const char *)v2 + dword_1301C, 0x10u);
    a1[16] = 0;
    result = 1;
  }
  else
  {
    result = 0;
  }
  return result;
}
// 1301C: using guessed type int dword_1301C;

//----- (0001161A) --------------------------------------------------------
int __stdcall sub_1161A(HANDLE Handle, int a2)
{
  char v2; // zf@2
  signed int v3; // ecx@2
  int v4; // edi@2
  char *v5; // esi@2
  char v6; // zf@8
  signed int v7; // ecx@8
  int v8; // edi@8
  char *v9; // esi@8
  CHAR *v11; // [sp-Ch] [bp-14h]@7
  PVOID Object; // [sp+4h] [bp-4h]@1

  if ( !ObReferenceObjectByHandle(Handle, 0, 0, 0, &Object, 0) )
  {
    v4 = (int)"hl2.exe";
    v5 = (char *)Object + dword_1301C;
    v3 = 8;
    v2 = 1;
    do
    {
      if ( !v3 )
        break;
      v2 = *v5++ == *(_BYTE *)v4++;
      --v3;
    }
    while ( v2 );
    if ( v2 )
    {
      byte_13051 = 0;
      sub_114D6();
      v11 = "Driver Mde 1 : Passiv";
LABEL_14:
      dword_13034 = 0;
      dword_13024 = 0;
      DbgPrint(v11);
      return dword_1303C(Handle, a2);
    }
    v9 = (char *)Object + dword_1301C;
    v8 = (int)"left4dead2.exe";
    v7 = 15;
    v6 = 1;
    do
    {
      if ( !v7 )
        break;
      v6 = *v9++ == *(_BYTE *)v8++;
      --v7;
    }
    while ( v6 );
    if ( v6 )
    {
      byte_13051 = 0;
      sub_114D6();
      v11 = "Driver Mde 2 : Passiv";
      goto LABEL_14;
    }
  }
  return dword_1303C(Handle, a2);
}
// 1303C: invalid function type has been ignored
// 1301C: using guessed type int dword_1301C;
// 13024: using guessed type int dword_13024;
// 13034: using guessed type int dword_13034;
// 1303C: using guessed type int (__stdcall *dword_1303C)(_DWORD, _DWORD);
// 13051: using guessed type char byte_13051;

//----- (000116B0) --------------------------------------------------------
int __stdcall sub_116B0(HANDLE Handle, int a2, int a3, int a4, int a5)
{
  char v5; // zf@2
  signed int v6; // ecx@2
  int v7; // edi@2
  char *v8; // esi@2
  char v9; // zf@10
  signed int v10; // ecx@10
  int v11; // edi@10
  char *v12; // esi@10
  CHAR *v14; // [sp-Ch] [bp-38h]@9
  PVOID Object; // [sp+8h] [bp-24h]@1
  int v16; // [sp+Ch] [bp-20h]@1
  int v17; // [sp+10h] [bp-1Ch]@1
  char v18; // [sp+14h] [bp-18h]@7
  unsigned int v19; // [sp+28h] [bp-4h]@1
  int v20; // [sp+2Ch] [bp+0h]@1

  v19 = (unsigned int)&v20 ^ dword_13004;
  v16 = a2;
  v17 = a3;
  if ( !ObReferenceObjectByHandle(Handle, 0, 0, 0, &Object, 0) )
  {
    v7 = (int)"hl2.exe";
    v8 = (char *)Object + dword_1301C;
    v6 = 8;
    v5 = 1;
    do
    {
      if ( !v6 )
        break;
      v5 = *v8++ == *(_BYTE *)v7++;
      --v6;
    }
    while ( v5 );
    if ( v5 )
    {
      sub_115D8(&v18);
      if ( !strncmp(&v18, "SmplxClntxxxx", 9u) && !byte_13051 )
      {
        v14 = "Driver Mde 1 : Active";
LABEL_18:
        DbgPrint(v14);
        byte_13051 = 1;
        return dword_13038(Handle, v16, v17, a4, a5);
      }
    }
    else
    {
      v12 = (char *)Object + dword_1301C;
      v11 = (int)"left4dead2.exe";
      v10 = 15;
      v9 = 1;
      do
      {
        if ( !v10 )
          break;
        v9 = *v12++ == *(_BYTE *)v11++;
        --v10;
      }
      while ( v9 );
      if ( v9 )
      {
        sub_115D8(&v18);
        if ( !strncmp(&v18, "SmplxClntxxxx", 9u) )
        {
          if ( !byte_13051 )
          {
            v14 = "Driver Mde 2 : Active";
            goto LABEL_18;
          }
        }
      }
    }
  }
  return dword_13038(Handle, v16, v17, a4, a5);
}
// 13038: invalid function type has been ignored
// 13004: using guessed type int dword_13004;
// 1301C: using guessed type int dword_1301C;
// 13038: using guessed type int (__stdcall *dword_13038)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 13051: using guessed type char byte_13051;

//----- (000117B2) --------------------------------------------------------
int __stdcall sub_117B2(HANDLE Handle, int a2, int a3, int a4, int a5, int a6)
{
  char v6; // zf@3
  signed int v7; // ecx@3
  int v8; // edi@3
  char *v9; // esi@3
  char v10; // zf@8
  signed int v11; // ecx@8
  int v12; // edi@8
  char *v13; // esi@8
  char v14; // zf@13
  signed int v15; // ecx@13
  int v16; // edi@13
  char *v17; // esi@13
  char v18; // zf@18
  signed int v19; // ecx@18
  int v20; // edi@18
  char *v21; // esi@18
  char v22; // zf@23
  signed int v23; // ecx@23
  int v24; // edi@23
  char *v25; // esi@23
  char v26; // zf@28
  signed int v27; // ecx@28
  __int16 *v28; // edi@28
  char *v29; // esi@28
  char v30; // zf@33
  signed int v31; // ecx@33
  int v32; // edi@33
  char *v33; // esi@33
  char v34; // zf@38
  signed int v35; // ecx@38
  int v36; // edi@38
  char *v37; // esi@38
  int result; // eax@48
  PVOID Object; // [sp+Ch] [bp-28h]@1
  int v40; // [sp+10h] [bp-24h]@1
  HANDLE v41; // [sp+14h] [bp-20h]@1
  unsigned int v42; // [sp+18h] [bp-1Ch]@1
  char v43; // [sp+1Ch] [bp-18h]@3
  unsigned int v44; // [sp+30h] [bp-4h]@1
  int v45; // [sp+34h] [bp+0h]@1

  v44 = (unsigned int)&v45 ^ dword_13004;
  v42 = a2;
  v40 = a6;
  v41 = Handle;
  if ( ObReferenceObjectByHandle(Handle, 0, 0, 0, &Object, 0) )
    goto LABEL_55;
  if ( byte_13051 != 1 )
    goto LABEL_55;
  sub_115D8(&v43);
  v6 = 1;
  v8 = (int)"left4dead2.exe";
  v9 = (char *)Object + dword_1301C;
  v7 = 15;
  do
  {
    if ( !v7 )
      break;
    v6 = *v9++ == *(_BYTE *)v8++;
    --v7;
  }
  while ( v6 );
  if ( !v6 )
  {
    v13 = (char *)Object + dword_1301C;
    v12 = (int)"hl2.exe";
    v11 = 8;
    v10 = 1;
    do
    {
      if ( !v11 )
        break;
      v10 = *v13++ == *(_BYTE *)v12++;
      --v11;
    }
    while ( v10 );
    if ( !v10 )
      goto LABEL_55;
  }
  v16 = (int)"hl2.exe";
  v17 = &v43;
  v15 = 8;
  v14 = 1;
  do
  {
    if ( !v15 )
      break;
    v14 = *v17++ == *(_BYTE *)v16++;
    --v15;
  }
  while ( v14 );
  if ( v14 )
    goto LABEL_55;
  v20 = (int)"left4dead2.exe";
  v21 = &v43;
  v19 = 15;
  v18 = 1;
  do
  {
    if ( !v19 )
      break;
    v18 = *v21++ == *(_BYTE *)v20++;
    --v19;
  }
  while ( v18 );
  if ( v18 )
    goto LABEL_55;
  v24 = (int)dword_11D64;
  v25 = &v43;
  v23 = 12;
  v22 = 1;
  do
  {
    if ( !v23 )
      break;
    v22 = *v25++ == *(_BYTE *)v24++;
    --v23;
  }
  while ( v22 );
  if ( v22 )
    goto LABEL_55;
  v28 = &word_11D5A;
  v29 = &v43;
  v27 = 10;
  v26 = 1;
  do
  {
    if ( !v27 )
      break;
    v26 = *v29++ == *(_BYTE *)v28;
    v28 = (__int16 *)((char *)v28 + 1);
    --v27;
  }
  while ( v26 );
  if ( v26 )
    goto LABEL_55;
  v32 = (int)dword_11D4C;
  v33 = &v43;
  v31 = 13;
  v30 = 1;
  do
  {
    if ( !v31 )
      break;
    v30 = *v33++ == *(_BYTE *)v32++;
    --v31;
  }
  while ( v30 );
  if ( v30 )
    goto LABEL_55;
  v36 = (int)"explorer.exe";
  v37 = &v43;
  v35 = 13;
  v34 = 1;
  do
  {
    if ( !v35 )
      break;
    v34 = *v37++ == *(_BYTE *)v36++;
    --v35;
  }
  while ( v34 );
  if ( v34 )
    goto LABEL_55;
  if ( !dword_13024 || !dword_13034 )
    sub_11116();
  if ( !dword_13024 || !dword_13034 )
  {
LABEL_55:
    result = dword_13028(v41, v42, a3, a4, a5, v40);
  }
  else
  {
    result = dword_13028(v41, v42, a3, a4, a5, v40);
    if ( v42 >= dword_13024 )
    {
      if ( v42 < dword_13024 + dword_13034 )
      {
        if ( a4 )
        {
          *(_DWORD *)(a4 + 4) = 0;
          *(_DWORD *)(a4 + 8) = 0;
          *(_DWORD *)(a4 + 16) = 65536;
          *(_DWORD *)(a4 + 20) = 1;
          *(_DWORD *)(a4 + 24) = 0;
        }
      }
    }
  }
  return result;
}
// 13028: invalid function type has been ignored
// 11D4C: using guessed type int dword_11D4C[3];
// 11D5A: using guessed type __int16 word_11D5A;
// 11D64: using guessed type int dword_11D64[3];
// 13004: using guessed type int dword_13004;
// 1301C: using guessed type int dword_1301C;
// 13024: using guessed type int dword_13024;
// 13028: using guessed type int (__stdcall *dword_13028)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 13034: using guessed type int dword_13034;
// 13051: using guessed type char byte_13051;

//----- (00011952) --------------------------------------------------------
int __stdcall sub_11952(HANDLE Handle, int a2, int a3, int a4, int a5)
{
  int v5; // esi@1
  char v6; // zf@3
  signed int v7; // ecx@3
  int v8; // edi@3
  char *v9; // esi@3
  char v10; // zf@8
  signed int v11; // ecx@8
  int v12; // edi@8
  char *v13; // esi@8
  char v14; // zf@13
  signed int v15; // ecx@13
  int v16; // edi@13
  char *v17; // esi@13
  char v18; // zf@18
  signed int v19; // ecx@18
  int v20; // edi@18
  char *v21; // esi@18
  char v22; // zf@23
  signed int v23; // ecx@23
  int v24; // edi@23
  char *v25; // esi@23
  char v26; // zf@28
  signed int v27; // ecx@28
  __int16 *v28; // edi@28
  char *v29; // esi@28
  char v30; // zf@33
  signed int v31; // ecx@33
  int v32; // edi@33
  char *v33; // esi@33
  char v34; // zf@38
  signed int v35; // ecx@38
  int v36; // edi@38
  char *v37; // esi@38
  unsigned int v38; // eax@43
  int v39; // ecx@44
  int v41; // [sp-10h] [bp-48h]@52
  int v42; // [sp-Ch] [bp-44h]@52
  int v43; // [sp-8h] [bp-40h]@52
  int v44; // [sp-4h] [bp-3Ch]@52
  PVOID Object; // [sp+Ch] [bp-2Ch]@1
  unsigned int v46; // [sp+10h] [bp-28h]@1
  int v47; // [sp+14h] [bp-24h]@1
  HANDLE v48; // [sp+18h] [bp-20h]@1
  int v49; // [sp+1Ch] [bp-1Ch]@1
  char v50; // [sp+20h] [bp-18h]@3
  unsigned int v51; // [sp+34h] [bp-4h]@1
  int v52; // [sp+38h] [bp+0h]@1

  v51 = (unsigned int)&v52 ^ dword_13004;
  v5 = a2;
  v49 = a3;
  v47 = a5;
  v48 = Handle;
  v46 = a2;
  if ( ObReferenceObjectByHandle(Handle, 0, 0, 0, &Object, 0) || byte_13051 != 1 )
    goto LABEL_54;
  sub_115D8(&v50);
  v6 = 1;
  v8 = (int)"left4dead2.exe";
  v9 = (char *)Object + dword_1301C;
  v7 = 15;
  do
  {
    if ( !v7 )
      break;
    v6 = *v9++ == *(_BYTE *)v8++;
    --v7;
  }
  while ( v6 );
  if ( !v6 )
  {
    v13 = (char *)Object + dword_1301C;
    v12 = (int)"hl2.exe";
    v11 = 8;
    v10 = 1;
    do
    {
      if ( !v11 )
        break;
      v10 = *v13++ == *(_BYTE *)v12++;
      --v11;
    }
    while ( v10 );
    if ( !v10 )
      goto LABEL_58;
  }
  v16 = (int)"hl2.exe";
  v17 = &v50;
  v15 = 8;
  v14 = 1;
  do
  {
    if ( !v15 )
      break;
    v14 = *v17++ == *(_BYTE *)v16++;
    --v15;
  }
  while ( v14 );
  if ( v14 )
    goto LABEL_58;
  v20 = (int)"left4dead2.exe";
  v21 = &v50;
  v19 = 15;
  v18 = 1;
  do
  {
    if ( !v19 )
      break;
    v18 = *v21++ == *(_BYTE *)v20++;
    --v19;
  }
  while ( v18 );
  if ( v18 )
    goto LABEL_58;
  v24 = (int)dword_11D64;
  v25 = &v50;
  v23 = 12;
  v22 = 1;
  do
  {
    if ( !v23 )
      break;
    v22 = *v25++ == *(_BYTE *)v24++;
    --v23;
  }
  while ( v22 );
  if ( v22 )
    goto LABEL_58;
  v28 = &word_11D5A;
  v29 = &v50;
  v27 = 10;
  v26 = 1;
  do
  {
    if ( !v27 )
      break;
    v26 = *v29++ == *(_BYTE *)v28;
    v28 = (__int16 *)((char *)v28 + 1);
    --v27;
  }
  while ( v26 );
  if ( v26 )
    goto LABEL_58;
  v32 = (int)dword_11D4C;
  v33 = &v50;
  v31 = 13;
  v30 = 1;
  do
  {
    if ( !v31 )
      break;
    v30 = *v33++ == *(_BYTE *)v32++;
    --v31;
  }
  while ( v30 );
  if ( v30 )
    goto LABEL_58;
  v36 = (int)"explorer.exe";
  v37 = &v50;
  v35 = 13;
  v34 = 1;
  do
  {
    if ( !v35 )
      break;
    v34 = *v37++ == *(_BYTE *)v36++;
    --v35;
  }
  while ( v34 );
  if ( v34 )
    goto LABEL_58;
  v38 = dword_13024;
  if ( !dword_13024 || (v39 = dword_13034, !dword_13034) )
  {
    sub_11116();
    v38 = dword_13024;
    v39 = dword_13034;
  }
  if ( !v38 || !v39 )
  {
LABEL_58:
    v5 = v46;
LABEL_54:
    v44 = v47;
    v43 = a4;
    v42 = v49;
    v41 = v5;
    return dword_13040(v48, v41, v42, v43, v44);
  }
  v5 = v46;
  if ( (v46 < v38 || v46 > v38 + v39) && (v46 + a4 < v38 || v46 > v38) )
    goto LABEL_54;
  v44 = v47;
  v43 = a4;
  v42 = v49;
  v41 = 0;
  return dword_13040(v48, v41, v42, v43, v44);
}
// 13040: invalid function type has been ignored
// 11D4C: using guessed type int dword_11D4C[3];
// 11D5A: using guessed type __int16 word_11D5A;
// 11D64: using guessed type int dword_11D64[3];
// 13004: using guessed type int dword_13004;
// 1301C: using guessed type int dword_1301C;
// 13024: using guessed type int dword_13024;
// 13034: using guessed type int dword_13034;
// 13040: using guessed type int (__stdcall *dword_13040)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 13051: using guessed type char byte_13051;

//----- (00011ACA) --------------------------------------------------------
ULONG __cdecl sub_11ACA()
{
  CHAR *v1; // [sp-4h] [bp-4h]@3

  sub_114D6();
  sub_11116();
  if ( dword_1302C && dword_13044 )
  {
    dword_13040 = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_110EA(dword_13044, (int)sub_11952);
    dword_13038 = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_110EA(dword_13018, (int)sub_116B0);
    dword_13028 = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_110EA(
                                                                                       dword_1302C,
                                                                                       (int)sub_117B2);
    dword_1303C = (int (__stdcall *)(_DWORD, _DWORD))sub_110EA(dword_13030, (int)sub_1161A);
    v1 = "Hked";
  }
  else
  {
    v1 = "Error Gettin' Function Indexes";
  }
  return DbgPrint(v1);
}
// 13018: using guessed type int dword_13018;
// 13028: using guessed type int (__stdcall *dword_13028)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1302C: using guessed type int dword_1302C;
// 13030: using guessed type int dword_13030;
// 13038: using guessed type int (__stdcall *dword_13038)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1303C: using guessed type int (__stdcall *dword_1303C)(_DWORD, _DWORD);
// 13040: using guessed type int (__stdcall *dword_13040)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 13044: using guessed type int dword_13044;

//----- (00011B4E) --------------------------------------------------------
ULONG __cdecl sub_11B4E()
{
  sub_110EA(dword_13044, (int)dword_13040);
  sub_110EA(dword_13018, (int)dword_13038);
  sub_110EA(dword_1302C, (int)dword_13028);
  sub_110EA(dword_13030, (int)dword_1303C);
  return DbgPrint("UnHked");
}
// 13018: using guessed type int dword_13018;
// 13028: using guessed type int (__stdcall *dword_13028)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1302C: using guessed type int dword_1302C;
// 13030: using guessed type int dword_13030;
// 13038: using guessed type int (__stdcall *dword_13038)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1303C: using guessed type int (__stdcall *dword_1303C)(_DWORD, _DWORD);
// 13040: using guessed type int (__stdcall *dword_13040)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 13044: using guessed type int dword_13044;

//----- (00014005) --------------------------------------------------------
int __cdecl sub_14005()
{
  ULONG v0; // eax@1
  int result; // eax@5

  v0 = dword_13004;
  if ( !dword_13004 || dword_13004 == -1153374642 )
  {
    v0 = (unsigned int)&dword_13004 ^ KeTickCount.LowPart;
    dword_13004 = (unsigned int)&dword_13004 ^ KeTickCount.LowPart;
    if ( &dword_13004 == (int *)KeTickCount.LowPart )
    {
      v0 = -1153374642;
      dword_13004 = -1153374642;
    }
  }
  result = ~v0;
  dword_13008 = result;
  return result;
}
// 13004: using guessed type int dword_13004;
// 13008: using guessed type int dword_13008;

//----- (0001403E) --------------------------------------------------------
NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
  sub_14005();
  return sub_11024((int)DriverObject, (int)RegistryPath);
}

// ALL OK, 16 function(s) have been successfully decompiled