PnpLogVetoInformation

_QWORD *__fastcall PnpLogVetoInformation(__int64 a1, _QWORD *a2){
  _QWORD *result; 
  bool i; 
  _QWORD *v6; 
  char v7; 
  _EPROCESS *v8; 
  __int64 v9; 
  _UNICODE_STRING *v10; 
  UINT8 *ProcessImageFileName; 
  _QWORD *j; 
  _QWORD *v13; 
  _STRING DestinationString; 
  _UNICODE_STRING v15; 
  _UNICODE_STRING *ImageName; 
  _EPROCESS *Process; 

  result = (_QWORD *)*a2;
  ImageName = 0i64;
  v15 = 0i64;
  Process = 0i64;
  for( i = a2 == result; ; i = a2 == result )
  {
    v6 = result - 3;
    if( i )
      break;
    v7 = 0;
    if( PsLookupProcessByProcessId((VOID *)*((unsigned int *)v6 + 4), &Process) >= 0 )
    {
      v8 = Process;
      if( PsGetAllocatedFullProcessImageName(Process, &ImageName) >= 0 )
      {
        v10 = ImageName;
        if( !ImageName->Length )
        {
          v7 = 1;
          DestinationString = 0i64;
          ExFreePoolWithTag(ImageName, 0);
          v10 = &v15;
          ImageName = &v15;
          ProcessImageFileName = PsGetProcessImageFileName(v8);
          RtlInitAnsiString(&DestinationString, (PCSZ)ProcessImageFileName);
          RtlAnsiStringToUnicodeString(&v15, &DestinationString, 1u);
        }
      }
      else
      {
        v10 = 0i64;
        ImageName = 0i64;
      }
      PnpDiagnosticTraceAppVeto(v9, (int)v8->UniqueProcessId, (__int64)v10, a1);
      for( j = (_QWORD *)*v6; ; j = (_QWORD *)v13[1] )
      {
        v13 = j - 1;
        if( v6 == j )
          break;
        PnpTraceDeviceRemoveProcessVeto();
      }
      if( v7 )
      {
        RtlFreeAnsiString(v10);
      }
      else if( v10 )
      {
        ExFreePoolWithTag(v10, 0);
      }
      ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
    }
    result = (_QWORD *)v6[3];
  }
  return result;
}

Referenced by: