PiPnpRtlObjectEventWorker
VOID __fastcall PiPnpRtlObjectEventWorker(WCHAR *ObjectName, _PNP_OBJECT_TYPE ObjectType, INT64 a3, INT64 a4, INT64 a5){
int v5;
_ETHREAD *v9;
int PWSTR;
_PI_PNPRTL_OBJECT_EVENT *v11;
int v12;
int v13;
__int64 v14;
_ETHREAD *v15;
_PI_PNPRTL_OBJECT_EVENT *v16;
__int64 v17;
const wchar_t *v18;
__int128 v19;
int v20;
_PI_PNPRTL_OBJECT_EVENT v21;
_PI_PNPRTL_OBJECT_EVENT *v22;
__int128 v23;
__int64 v24;
__int64 v25;
__int64 v26;
const wchar_t *v27;
VOID **PoolWithTag;
_PI_PNPRTL_OBJECT_EVENT *v29;
_RTL_AVL_TABLE *v30;
_EX_PUSH_LOCK *v31;
_ETHREAD *v32;
__int64 v33;
int v34;
VOID *v35;
_ETHREAD *v36;
_ETHREAD *v37;
HPNPOPCTX *i;
HPNPOPCTX *v39;
HPNPOPCTX *v40;
_PI_PNPRTL_OBJECT_EVENT *v41;
_PI_PNPRTL_OBJECT_EVENT **v42;
_PI_PNPRTL_OBJECT_EVENT v43;
__int64 *v44;
__int64 v45;
__int64 *v46;
__int64 **v47;
_ETHREAD *CurrentThread;
HPNPOPCTX *v49;
HPNPOPCTX *v50;
_PI_PNPRTL_OBJECT_EVENT *v51;
_PI_PNPRTL_OBJECT_EVENT **v52;
_PI_DQ_OBJECT_MANAGER *ObjectManagerForPnpObjectType;
_PI_PNPRTL_OBJECT_EVENT *a4a;
char ValueNotChanged[8];
HPNPOPCTX *hPnpOpCtx;
__int128 v57;
__int128 v58;
if( ObjectType < PNP_OBJECT_TYPE_CUSTOM_2 )
{
hPnpOpCtx = 0i64;
v5 = a3;
a4a = 0i64;
ValueNotChanged[0] = 0;
if( (_DWORD)a3 == 1 )
goto LABEL_59;
if( PiPnpRtlBeginOperation(&hPnpOpCtx) < 0
|| (v9 = (_ETHREAD *)KeGetCurrentThread(),
--v9->Tcb.KernelApcDisable,
ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 3456, 1),
PWSTR = PiPnpRtlObjectEventCreate(ObjectName, ObjectType, hPnpOpCtx, &a4a),
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3456)),
KeLeaveCriticalRegionThread(KeGetCurrentThread()),
PWSTR < 0) )
{
v11 = a4a;
LABEL_54:
if( !v11 )
goto LABEL_59;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 3456, 1);
if( *((_QWORD *)a4a + 7) )
{
LABEL_58:
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3456));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
LABEL_59:
ObjectManagerForPnpObjectType = PiDqGetObjectManagerForPnpObjectType(ObjectType);
if( ObjectManagerForPnpObjectType )
PiDqObjectManagerMakeInconsistent(ObjectManagerForPnpObjectType);
goto LABEL_21;
}
v49 = hPnpOpCtx;
RtlDeleteElementGenericTableAvl((PRTL_AVL_TABLE)(hPnpOpCtx + 6), &a4a);
v50 = v49 + 32;
v51 = a4a + 14;
v52 = (_PI_PNPRTL_OBJECT_EVENT **)*((_QWORD *)v50 + 1);
if( *v52 == v50 )
{
*(_QWORD *)v51 = v50;
*((_QWORD *)v51 + 1) = v52;
*v52 = v51;
*((_QWORD *)v50 + 1) = v51;
goto LABEL_58;
}
LABEL_61:
__fastfail(3u);
}
v11 = a4a;
if( a4a )
{
v12 = v5 - 2;
if( !v12 )
{
a4a[1] |= 1u;
goto LABEL_19;
}
v13 = v12 - 1;
if( !v13 )
{
a4a[1] |= 2u;
v31 = (_EX_PUSH_LOCK *)*((_QWORD *)a4a + 1);
v32 = (_ETHREAD *)KeGetCurrentThread();
--v32->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(v31, 0i64);
v33 = *((_QWORD *)a4a + 1);
v34 = *(_DWORD *)(v33 + 32);
*(_DWORD *)(v33 + 32) = v34 & 0xFFFFFFFE;
ExReleasePushLockEx(*((_QWORD *)a4a + 1), 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
if( (v34 & 1) != 0 )
PiDmRemoveCacheReferenceForObject(ObjectType, ObjectName, v35);
v36 = (_ETHREAD *)KeGetCurrentThread();
--v36->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 3456, 1, (INT64)v35);
v37 = (_ETHREAD *)KeGetCurrentThread();
--v37->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 3584, 1);
for( i = (HPNPOPCTX *)*(&PnpReplaceEvent + 428);
i != (HPNPOPCTX *)((char *)&PnpReplaceEvent + 3424);
i = *(HPNPOPCTX **)i )
{
if( i != hPnpOpCtx )
{
v44 = (__int64 *)RtlLookupElementGenericTableAvl((_RTL_AVL_TABLE *)(i + 6), &a4a);
if( v44 )
{
v45 = *v44;
RtlDeleteElementGenericTableAvl((PRTL_AVL_TABLE)(i + 6), v44);
v46 = (__int64 *)(v45 + 56);
v47 = (__int64 **)*((_QWORD *)i + 17);
if( *v47 != (__int64 *)(i + 32) )
goto LABEL_61;
*v46 = (__int64)(i + 32);
v46[1] = (__int64)v47;
*v47 = v46;
*((_QWORD *)i + 17) = v46;
}
}
}
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3584));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
PiPnpRtlObjectEventDispatch(a4a);
v39 = hPnpOpCtx;
RtlDeleteElementGenericTableAvl((PRTL_AVL_TABLE)(hPnpOpCtx + 6), &a4a);
v40 = v39 + 32;
v41 = a4a + 14;
v42 = (_PI_PNPRTL_OBJECT_EVENT **)*((_QWORD *)v40 + 1);
if( *v42 != v40 )
goto LABEL_61;
*((_QWORD *)a4a + 8) = v42;
*(_QWORD *)v41 = v40;
*v42 = v41;
*((_QWORD *)v40 + 1) = v41;
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3456));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v11 = 0i64;
a4a = 0i64;
goto LABEL_20;
}
v14 = (unsigned int)(v13 - 1);
if( !(_DWORD)v14 )
{
PiDmObjectProcessPropertyChange(
ObjectType,
ObjectName,
*((_PI_DM_OBJECT **)a4a + 1),
*(WCHAR **)(a4 + 8),
*(_DEVPROPKEY **)(a4 + 16),
(UINT8 *)ValueNotChanged);
if( ValueNotChanged[0] )
{
LABEL_19:
v11 = a4a;
goto LABEL_20;
}
v15 = (_ETHREAD *)KeGetCurrentThread();
--v15->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 3456, 1);
v16 = a4a;
if( !*((_QWORD *)a4a + 7) )
{
v17 = *(_QWORD *)(a4 + 16);
v18 = *(const wchar_t **)(a4 + 8);
DWORD1(v58) = a5;
v19 = *(_OWORD *)v17;
v20 = *(_DWORD *)(v17 + 16);
LODWORD(v58) = v20;
v57 = v19;
*((_QWORD *)&v58 + 1) = v18;
if( a4a[19] )
{
do
{
if( v20 == v16[8 * v14 + 24] )
{
v25 = 8i64 * (unsigned int)v14;
v26 = v57 - *(_QWORD *)&v16[v25 + 20];
if( (_QWORD)v57 == *(_QWORD *)&v16[v25 + 20] )
v26 = *((_QWORD *)&v57 + 1) - *(_QWORD *)&v16[v25 + 22];
if( !v26 && (_DWORD)a5 == v16[v25 + 25] )
{
v27 = *(const wchar_t **)&v16[v25 + 26];
if( v18 == v27 )
goto LABEL_18;
if( v18 && v27 )
{
if( !wcsicmp(v18, v27) )
goto LABEL_18;
v16 = a4a;
}
}
}
v14 = (unsigned int)(v14 + 1);
}
while( (unsigned int)v14 < v16[19] );
}
if( (_DWORD)a5 == 1 )
{
v43 = v16[1];
if( (v43 & 4) == 0 )
{
v16[1] = v43 | 4;
SeCaptureSubjectContext((INT64)(a4a + 6));
v16 = a4a;
}
}
v21 = v16[18];
if( v16[19] != v21 )
goto LABEL_16;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 32i64 * (unsigned int)(2 * v21) + 80, 1097887312i64);
v29 = (_PI_PNPRTL_OBJECT_EVENT *)PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, a4a, 32 * a4a[19] + 80);
v30 = (_RTL_AVL_TABLE *)(hPnpOpCtx + 6);
v29[18] *= 2;
*(_QWORD *)RtlLookupElementGenericTableAvl(v30, &a4a) = v29;
ExFreePoolWithTag(a4a, 0x41706E50u);
a4a = v29;
LABEL_16:
PWSTR = PnpAllocatePWSTR(*(WCHAR **)(a4 + 8), 0x7FFFFFFFui64, 0x41706E50u, (PVOID *)&v58 + 1);
if( PWSTR >= 0 )
{
v22 = a4a;
v23 = v58;
v24 = 8i64 * (unsigned int)a4a[19];
*(_OWORD *)&a4a[v24 + 20] = v57;
*(_OWORD *)&v22[v24 + 24] = v23;
++a4a[19];
}
goto LABEL_18;
}
PWSTR = -1073741670;
}
LABEL_18:
ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3456));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
goto LABEL_19;
}
if( (_DWORD)v14 == 1 )
{
a4a[1] |= 8u;
goto LABEL_19;
}
}
LABEL_20:
if( PWSTR >= 0 )
{
LABEL_21:
if( hPnpOpCtx )
PiPnpRtlEndOperation(hPnpOpCtx);
return;
}
goto LABEL_54;
}
}Referenced by:
PiDqIrpPropertySet
PiPnpRtlObjectEventCallback