PiDqIrpQueryCreate
NTSTATUS __stdcall PiDqIrpQueryCreate(IRP *Irp){
IRP *v1;
__int64 v2;
INT64 v3;
char v4;
_GUID *v5;
_ETHREAD *CurrentThread;
int v7;
int v8;
int ValidateQueryData;
INT64 *v10;
_BYTE *v11;
__int64 v12;
INT64 v13;
_ETHREAD *v14;
PVOID v16;
WCHAR *v17;
INT64 v18;
int v19;
int v20;
const wchar_t *v21;
WCHAR *v22;
int v23;
WCHAR *v24;
unsigned int v25;
void *v26;
unsigned int v27;
_WORD *v28;
void *v29;
int v30;
void *v31;
void *v32;
int v33;
unsigned int CurrentThreadProcessId;
INT64 v35;
unsigned int v36;
void *PoolWithTag;
unsigned int v38;
PVOID v39;
_WORD *v40;
INT64 a5;
char v42;
WCHAR *P;
UINT64 NumberOfBytes;
SIZE_T v45;
PVOID v46;
unsigned int a4;
IRP *v48;
PVOID v49;
PVOID v50;
INT64 v51;
PVOID v52;
PVOID v53;
_GUID *v54;
IRP *v55;
__int64 v56;
INT64 a1;
ULONG_PTR BugCheckParameter2;
_DWORD v59[4];
_GUID ActivityId;
v1 = Irp;
v55 = Irp;
v48 = Irp;
v2 = *((_QWORD *)Irp + 23);
v56 = v2;
v50 = (PVOID)v2;
v53 = *(PVOID *)(*(_QWORD *)(v2 + 48) + 32i64);
v3 = (INT64)v53;
v4 = 0;
v5 = 0i64;
v54 = 0i64;
ActivityId = 0i64;
v42 = 0;
a4 = 0;
LODWORD(v51) = 0;
*(_OWORD *)v59 = 0i64;
if( !v53 )
{
ValidateQueryData = -1073741637;
goto LABEL_18;
}
if( !*((_QWORD *)Irp + 3) )
{
ValidateQueryData = -1073741811;
goto LABEL_18;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
BugCheckParameter2 = v3 + 64;
ExAcquirePushLockExclusiveEx(v3 + 64, 0i64);
v7 = *(_DWORD *)(v3 + 216);
if( (v7 & 8) != 0 )
{
ValidateQueryData = -1073741536;
}
else if( (v7 & 0x10) != 0 || (v8 = v7 | 0x10, *(_DWORD *)(v3 + 216) = v8, v4 = 1, (v8 & 4) != 0) )
{
ValidateQueryData = -1073741637;
}
else
{
if( *(_DWORD *)(v2 + 8) >= 0x10u )
{
ValidateQueryData = MesDecodeBufferHandleCreate(*((_QWORD *)v1 + 3), *(unsigned int *)(v2 + 16), v3 + 16);
if( ValidateQueryData < 0 )
goto LABEL_15;
v10 = (INT64 *)(v3 + 24);
NdrMesTypeDecode3(*(_QWORD *)(v3 + 16), "TP 3\a", &off_140001290, &off_140C01A50, 0, v3 + 24);
ValidateQueryData = PiDqQueryValidateQueryData(*v10);
if( ValidateQueryData < 0 )
goto LABEL_14;
if( !PnpIsNullGuid((GUID *)*v10) )
{
ActivityId = *(_GUID *)*v10;
IoSetActivityIdThread(&ActivityId, v11);
v5 = (_GUID *)v12;
v54 = (_GUID *)v12;
v42 = 1;
}
if( (byte_140C130BA & 0x40) == 0 )
{
LABEL_13:
*(_DWORD *)(v3 + 216) |= 4u;
LABEL_14:
v4 = 1;
goto LABEL_15;
}
v16 = 0i64;
v46 = 0i64;
v53 = 0i64;
a1 = 0i64;
v50 = 0i64;
v17 = 0i64;
v52 = 0i64;
v49 = 0i64;
v18 = *v10;
if( (int)PiDqConvertObjectTypeToString(*(unsigned int *)(v18 + 16), (const WCHAR **)&a1) < 0 )
{
LABEL_87:
if( v49 )
ExFreePoolWithTag(v49, 0x58706E50u);
if( v17 )
ExFreePoolWithTag(v17, 0x58706E50u);
if( v50 )
ExFreePoolWithTag(v50, 0x58706E50u);
if( v52 )
ExFreePoolWithTag(v52, 0x58706E50u);
if( v16 )
ExFreePoolWithTag(v16, 0x58706E50u);
v5 = v54;
goto LABEL_13;
}
v19 = 0;
v48 = 0i64;
v20 = *(_DWORD *)(v18 + 20);
if( v20 )
{
if( v20 == 1 )
{
v21 = L"Instance";
}
else
{
if( v20 != 2 )
{
v19 = -1073741811;
goto LABEL_41;
}
v21 = L"Instances";
}
}
else
{
v21 = L"Type";
}
v48 = (IRP *)v21;
LABEL_41:
if( v19 < 0 )
goto LABEL_87;
if( v20 == 1 )
{
v53 = *(PVOID *)(v18 + 24);
}
else if( v20 == 2 )
{
v36 = *(_DWORD *)(v18 + 24);
if( v36 <= 2 )
goto LABEL_87;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 2i64 * v36, 0x58706E50ui64);
v49 = PoolWithTag;
if( !PoolWithTag )
goto LABEL_87;
memmove((UINT8 *)PoolWithTag, *(UINT8 **)(v18 + 32), 2i64 * *(unsigned int *)(v18 + 24));
v38 = *(_DWORD *)(v18 + 24) - 2;
v39 = v49;
if( *(_DWORD *)(v18 + 24) != 2 )
{
v40 = (char *)v49 + 2 * v38;
do
{
if( !*v40 )
*v40 = 32;
--v40;
--v38;
}
while( v38 );
}
v53 = v39;
}
LODWORD(NumberOfBytes) = 512;
v22 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x58706E50ui64);
P = v22;
if( !v22 )
{
v17 = 0i64;
goto LABEL_87;
}
v23 = PiDqConvertQueryFlagsToString(*(unsigned int *)(v18 + 40), v22, 0x200ui64, &NumberOfBytes);
if( v23 == -1073741789 )
{
ExFreePoolWithTag(P, 0x58706E50u);
v24 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x58706E50ui64);
P = v24;
if( !v24 )
{
v17 = 0i64;
v16 = 0i64;
goto LABEL_87;
}
v23 = PiDqConvertQueryFlagsToString(
*(unsigned int *)(v18 + 40),
v24,
(unsigned int)NumberOfBytes,
&NumberOfBytes);
}
if( v23 < 0 )
goto LABEL_85;
if( (*(_DWORD *)(v18 + 40) & 4) != 0 )
{
v25 = *(_DWORD *)(v18 + 48);
if( v25 <= 2 )
goto LABEL_85;
v26 = ExAllocatePoolWithTag(PagedPool, 2i64 * v25, 0x58706E50ui64);
v50 = v26;
if( !v26 )
goto LABEL_85;
memmove((UINT8 *)v26, *(UINT8 **)(v18 + 56), 2i64 * *(unsigned int *)(v18 + 48));
v27 = *(_DWORD *)(v18 + 48) - 2;
if( *(_DWORD *)(v18 + 48) != 2 )
{
v28 = (char *)v50 + 2 * v27;
do
{
if( !*v28 )
*v28 = 32;
--v28;
--v27;
}
while( v27 );
}
}
if( !*(_DWORD *)(v18 + 64) )
goto LABEL_63;
HIDWORD(NumberOfBytes) = 512;
v29 = ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x58706E50ui64);
v52 = v29;
if( v29 )
{
v30 = PnpConvertDevpropcompkeyArrayToString(
*(DEVPROPCOMPKEY **)(v18 + 72),
*(unsigned int *)(v18 + 64),
(WCHAR *)v29,
0x200ui64,
(UINT64 *)((char *)&NumberOfBytes + 4));
if( v30 == -1073741789 )
{
ExFreePoolWithTag(v52, 0x58706E50u);
v31 = ExAllocatePoolWithTag(PagedPool, HIDWORD(NumberOfBytes), 0x58706E50ui64);
v52 = v31;
if( !v31 )
goto LABEL_85;
v30 = PnpConvertDevpropcompkeyArrayToString(
*(DEVPROPCOMPKEY **)(v18 + 72),
*(unsigned int *)(v18 + 64),
(WCHAR *)v31,
HIDWORD(NumberOfBytes),
(UINT64 *)((char *)&NumberOfBytes + 4));
}
if( v30 >= 0 )
{
LABEL_63:
if( !*(_DWORD *)(v18 + 80) )
goto LABEL_69;
LODWORD(v45) = 512;
v32 = ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x58706E50ui64);
v46 = v32;
if( v32 )
{
v33 = FilterConvertToString(
*(unsigned int *)(v18 + 80),
*(_QWORD *)(v18 + 88),
0x200ui64,
(WCHAR *)v32,
&v45);
if( v33 != -1073741789 )
goto LABEL_68;
ExFreePoolWithTag(v46, 0x58706E50u);
v32 = ExAllocatePoolWithTag(PagedPool, (unsigned int)v45, 0x58706E50ui64);
v46 = v32;
if( v32 )
{
v33 = FilterConvertToString(
*(unsigned int *)(v18 + 80),
*(_QWORD *)(v18 + 88),
(unsigned int)v45,
(WCHAR *)v32,
&v45);
LABEL_68:
if( v33 < 0 )
{
LABEL_84:
v16 = v46;
goto LABEL_86;
}
LABEL_69:
if( (byte_140C130BA & 0x40) != 0 )
{
CurrentThreadProcessId = (unsigned int)PsGetCurrentThreadProcessId();
v16 = v46;
v17 = P;
LODWORD(a5) = CurrentThreadProcessId;
McTemplateK0pqzzzzzzz_EtwWriteTransfer(a1, v35, (GUID *)v18, v3, a5, a1, v48, v53, P, v50, v52, v46);
goto LABEL_87;
}
goto LABEL_84;
}
}
v16 = v32;
LABEL_86:
v17 = P;
goto LABEL_87;
}
}
LABEL_85:
v16 = 0i64;
goto LABEL_86;
}
ValidateQueryData = -1073741789;
}
LABEL_15:
ExReleasePushLockEx(BugCheckParameter2, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v2 = v56;
v1 = v55;
if( ValidateQueryData >= 0 )
{
v13 = *(unsigned int *)(v56 + 8);
if( (unsigned int)v13 <= 0x10 )
a4 = 16;
else
ValidateQueryData = PiDqQuerySerializeActionQueue(v3, *((_QWORD *)v55 + 3), v13, &a4, (INT64)&v51);
}
LABEL_18:
if( v4 )
{
v14 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v14 + 242);
ExAcquirePushLockExclusiveEx(v3 + 64, 0i64);
if( ValidateQueryData < 0 )
{
*(_DWORD *)(v3 + 216) |= 1u;
PiDqQueryFreeActiveData(v3);
}
else
{
PiDqQueryGetNextIoctlInfo(v3, *(unsigned int *)(v2 + 8), (unsigned int)v51, v59);
}
*(_DWORD *)(v3 + 216) &= ~0x10u;
ExReleasePushLockEx(v3 + 64, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
PiDqIrpComplete((__int64)v1, ValidateQueryData, a4, v59);
if( v42 )
IoClearActivityIdThread(v5);
return ValidateQueryData;
}Referenced by:
PiDqDispatch