PnpChainDereferenceComplete
void __fastcall PnpChainDereferenceComplete(PDEVICE_OBJECT DeviceObject, int a2, INT64 a3){
_ETHREAD *CurrentThread;
_DEVICE_TAGGED_FOR_REMOVAL v6;
__int64 *i;
_DEVICE_TAGGED_FOR_REMOVAL *v8;
__int64 v9;
int v10;
__int64 v11;
bool v12;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 6176, 1, a3);
for( i = (__int64 *)*(&PnpReplaceEvent + 788); ; i = (__int64 *)*i )
{
if( i == (__int64 *)((char *)&PnpReplaceEvent + 6304) )
goto LABEL_14;
if( !*((_BYTE *)i + 104) && IopSetRelationsTag((_RELATION_LIST *)i[8], DeviceObject, v6) >= 0 )
{
v8 = *(_DEVICE_TAGGED_FOR_REMOVAL **)i[8];
v9 = i[7];
v10 = *((_DWORD *)v8 + 2);
v6 = *v8;
v11 = v9 ? *(_QWORD *)(*(_QWORD *)(v9 + 312) + 40i64) : 0i64;
if( v10 == v6 && *(_DWORD *)(v11 + 300) != 782 )
break;
}
}
v12 = byte_140C50311 == 0;
*((_BYTE *)i + 104) = 1;
if( !v12 )
{
LABEL_14:
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6176));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return;
}
byte_140C50311 = 1;
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6176));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( a2 && KeGetCurrentThread()->ApcState.Process == PsInitialSystemProcess )
{
PnpDelayedRemoveWorker(0i64);
}
else
{
*(&PnpReplaceEvent + 1015) = 0i64;
*(&PnpReplaceEvent + 1012) = 0i64;
*(&PnpReplaceEvent + 1014) = PnpDelayedRemoveWorker;
ExQueueWorkItem((PWORK_QUEUE_ITEM)&PnpReplaceEvent + 253, DelayedWorkQueue);
}
}Referenced by:
IopCompleteUnloadOrDelete
PnpIsChainDereferenced