PiDqQueryCreate

NTSTATUS __stdcall PiDqQueryCreate(PI_DQ_QUERY **Query){
  VOID ***v1; 
  VOID ***v2; 
  char v3; 
  NTSTATUS v4; 
  VOID **PoolWithTag; 
  VOID **v6; 
  signed __int64 v7; 

  v2 = v1;
  v3 = (char)Query;
  v4 = 0;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0xE8ui64, 1483763280i64);
  v6 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, 0xE8u);
  *((_DWORD *)v6 + 53) = 1;
  v7 = _InterlockedIncrement64((_QWORD *)&PnpReplaceEvent + 242);
  v6[8] = 0i64;
  v6[28] = (VOID *)v7;
  RtlInitializeGenericTableAvl(
    (PRTL_AVL_TABLE)(v6 + 9),
    (PRTL_AVL_COMPARE_ROUTINE)PiDqCompareAddresses,
    (PRTL_AVL_ALLOCATE_ROUTINE)PiDqAllocateGenericTableEntry,
    (PRTL_AVL_FREE_ROUTINE)PiDqFreeGenericTableEntry,
    0i64);
  v6[25] = v6 + 24;
  v6[24] = v6 + 24;
  if( v3 )
    *((_DWORD *)v6 + 54) |= 2u;
  SeCaptureSubjectContext((INT64)(v6 + 4));
  *v2 = v6;
  return v4;
}

Referenced by: