PiProcessQueryAndCancelRemoval
NTSTATUS __stdcall PiProcessQueryAndCancelRemoval(
INT64 a1,
INT64 a2,
UINT64 **a3,
UINT64 a4,
VOID **a5,
INT64 *a6,
const VOID **a7){
unsigned int v9;
CHAR v10;
unsigned int v11;
VOID **v12;
_UNICODE_STRING *v13;
int v14;
NTSTATUS RemovalInKernelMode;
__int64 v17;
char *v18;
__int64 v19;
__int64 v20;
VOID **CriticalMemory;
char v22;
int v23[3];
unsigned int v24;
v24 = a4;
v9 = a1;
v23[0] = 0;
v10 = PiEventAreDeviceRelationsExcluded(a1);
v12 = (VOID **)v11;
v22 = v10;
v13 = (_UNICODE_STRING *)(a6 + 1);
PnpNotifyUserModeDeviceRemoval(
a2,
*a7,
(__int128 *)&GUID_TARGET_DEVICE_QUERY_REMOVE,
(__int64)a6,
(__int64)(a6 + 1),
v23);
RemovalInKernelMode = v14;
if( v14 < 0 )
{
PnpFinalizeVetoedRemove(a2, *(_DWORD *)a6, v13);
if( !v23[0] )
return RemovalInKernelMode;
v17 = (unsigned int)v23[0];
v18 = (char *)*a7;
do
{
v19 = -1i64;
do
++v19;
while( *(_WORD *)&v18[2 * v19] );
v18 += 2 * v19 + 2;
--v17;
}
while( v17 );
v20 = (v18 - (_BYTE *)*a7) >> 1;
CriticalMemory = PnpAllocateCriticalMemory(v9, PagedPool, 2i64 * (unsigned int)(v20 + 1), 0x4B706E50u);
v12 = CriticalMemory;
if( !CriticalMemory )
return -1073741670;
memmove(CriticalMemory, *a7, 2 * v20);
*((_WORD *)v12 + (unsigned int)(v20 + 1) - 1) = 0;
PnpNotifyUserModeDeviceRemoval(a2, v12, (__int128 *)&GUID_TARGET_DEVICE_REMOVE_CANCELLED, 0i64, 0i64, 0i64);
goto LABEL_15;
}
RemovalInKernelMode = PipProcessQueryRemovalInKernelMode(v9, a2, (INT64)a3, v24, a5, (INT64)a6);
if( RemovalInKernelMode < 0 )
{
PnpFinalizeVetoedRemove(a2, *(_DWORD *)a6, v13);
PnpNotifyUserModeDeviceRemoval(a2, *a7, (__int128 *)&GUID_TARGET_DEVICE_REMOVE_CANCELLED, 0i64, 0i64, 0i64);
return RemovalInKernelMode;
}
if( *(_DWORD *)(a2 + 16) == 54 )
{
RemovalInKernelMode = PnpCancelRemoveOnHungDevices(a2, v9, v22, (_RELATION_LIST *)a3, a7);
LABEL_15:
if( v12 )
ExFreePoolWithTag(v12, 0x4B706E50u);
}
return RemovalInKernelMode;
}Referenced by:
PnpProcessQueryRemoveAndEject