PiDqQueryApplyObjectEvent
VOID __stdcall PiDqQueryApplyObjectEvent(_PI_DQ_QUERY *Query, _PI_PNPRTL_OBJECT_EVENT *ObjectEvent){
_PI_PNPRTL_OBJECT_EVENT v2;
NTSTATUS EvaluateFilter;
char v6;
char v7;
UINT8 v8;
__int64 v9;
int v10;
int v11;
unsigned int v12;
unsigned int v13;
__int64 v14;
__int64 v15;
unsigned int v16;
__int64 v17;
unsigned int v18;
__int64 v19;
__int64 v20;
__int64 v21;
bool v22;
_ETHREAD *CurrentThread;
bool v24;
_PI_PNPRTL_OBJECT_EVENT v25;
char v26;
bool v27;
_DEV_QUERY_RESULT_ACTION v28;
int v29;
_ETHREAD *v30;
__int64 v31;
const wchar_t *v32;
const wchar_t *v33;
__int64 v34;
const wchar_t *v35;
const wchar_t *v36;
unsigned int v37;
unsigned int v38;
__int64 v39;
__int64 v40;
__int64 v41;
int v42;
char v43;
NTSTATUS v44;
__int64 v45;
_PI_PNPRTL_OBJECT_EVENT v46;
_ETHREAD *v47;
_ETHREAD *v48;
unsigned int v49;
__int64 v50;
const wchar_t *i;
__int64 v52;
const wchar_t *v53;
__int64 v54;
int v55;
const wchar_t *v56;
__int64 v57;
_ETHREAD *v58;
_SECURITY_SUBJECT_CONTEXT *SecuritySubjectContext;
UINT8 *v60;
INT64 v61;
_PI_DQ_QUERY_ACTION_QUEUE_ENTRY *Entry;
__int64 Buffer[2];
_BYTE savedregs[56];
char v65;
NTSTATUS Matched;
UINT8 IsSameUser;
v2 = ObjectEvent[1];
Matched = 0;
Entry = 0i64;
HIDWORD(v61) = 0;
LOBYTE(v61) = 0;
EvaluateFilter = 0;
v65 = 0;
v6 = 0;
IsSameUser = 0;
v7 = 0;
v8 = 0;
if( (v2 & 3) != 0 || (v2 & 8) == 0 && !ObjectEvent[19] )
goto LABEL_25;
if( (v2 & 4) != 0 )
{
Matched = PiDqSameUserHive(
(_SECURITY_SUBJECT_CONTEXT *)Query + 1,
(_SECURITY_SUBJECT_CONTEXT *)(ObjectEvent + 6),
&IsSameUser);
if( Matched < 0 )
goto LABEL_139;
v8 = IsSameUser;
v6 = 0;
}
v9 = *((_QWORD *)Query + 3);
v10 = *(_DWORD *)(v9 + 40) & 4;
if( (*(_DWORD *)(v9 + 40) & 2) != 0 )
{
if( !v10 )
{
LABEL_52:
LOBYTE(EvaluateFilter) = 1;
v65 = 1;
goto LABEL_13;
}
v49 = 0;
if( !ObjectEvent[19] )
goto LABEL_36;
while( 1 )
{
v50 = 8i64 * v49;
if( ObjectEvent[v50 + 25] != 1 || v8 )
{
if( !*(_QWORD *)&ObjectEvent[v50 + 26] )
goto LABEL_52;
for( i = *(const wchar_t **)(*((_QWORD *)Query + 3) + 56i64); *i; i += v52 + 1 )
{
if( !wcsicmp(*(const wchar_t **)&ObjectEvent[v50 + 26], i) )
goto LABEL_52;
v52 = -1i64;
do
++v52;
while( i[v52] );
}
}
if( ++v49 >= ObjectEvent[19] )
break;
v8 = IsSameUser;
}
}
else
{
v11 = *(_DWORD *)(v9 + 64);
if( !v10 )
{
v12 = 0;
if( v11 )
{
do
{
v13 = 0;
v14 = *(_QWORD *)(v9 + 72) + 32i64 * v12;
if( ObjectEvent[19] )
{
while( 1 )
{
v15 = 8i64 * v13;
if( *(_DWORD *)(v14 + 16) == ObjectEvent[v15 + 24] )
{
v31 = *(_QWORD *)v14 - *(_QWORD *)&ObjectEvent[v15 + 20];
if( *(_QWORD *)v14 == *(_QWORD *)&ObjectEvent[v15 + 20] )
v31 = *(_QWORD *)(v14 + 8) - *(_QWORD *)&ObjectEvent[v15 + 22];
if( !v31 && *(_DWORD *)(v14 + 20) == ObjectEvent[v15 + 25] )
{
v32 = *(const wchar_t **)(v14 + 24);
v33 = *(const wchar_t **)&ObjectEvent[v15 + 26];
if( (v32 == v33 || v32 && v33 && !wcsicmp(v32, v33)) && (ObjectEvent[v15 + 25] != 1 || IsSameUser) )
break;
}
}
if( ++v13 >= ObjectEvent[19] )
goto LABEL_11;
}
LOBYTE(EvaluateFilter) = 1;
v65 = 1;
}
else
{
LABEL_11:
LOBYTE(EvaluateFilter) = v65;
}
v9 = *((_QWORD *)Query + 3);
++v12;
}
while( v12 < *(_DWORD *)(v9 + 64) );
goto LABEL_13;
}
LABEL_36:
LOBYTE(EvaluateFilter) = 0;
goto LABEL_13;
}
v37 = 0;
if( !v11 )
goto LABEL_36;
while( 1 )
{
v38 = 0;
v39 = *(_QWORD *)(v9 + 72) + 32i64 * v37;
if( ObjectEvent[19] )
break;
LABEL_57:
v9 = *((_QWORD *)Query + 3);
if( ++v37 >= *(_DWORD *)(v9 + 64) )
goto LABEL_74;
v8 = IsSameUser;
}
while( 1 )
{
v40 = 8i64 * v38;
if( *(_DWORD *)(v39 + 16) == ObjectEvent[v40 + 24] )
{
v45 = *(_QWORD *)v39 - *(_QWORD *)&ObjectEvent[v40 + 20];
if( *(_QWORD *)v39 == *(_QWORD *)&ObjectEvent[v40 + 20] )
v45 = *(_QWORD *)(v39 + 8) - *(_QWORD *)&ObjectEvent[v40 + 22];
if( !v45 )
{
v46 = ObjectEvent[v40 + 25];
if( *(_DWORD *)(v39 + 20) == v46 && (v46 != 1 || v8) )
{
if( !*(_QWORD *)&ObjectEvent[v40 + 26] )
goto LABEL_52;
v53 = *(const wchar_t **)(*((_QWORD *)Query + 3) + 56i64);
if( *v53 )
{
while( wcsicmp(*(const wchar_t **)&ObjectEvent[v40 + 26], v53) )
{
v54 = -1i64;
do
++v54;
while( v53[v54] );
v53 += v54 + 1;
if( !*v53 )
{
v6 = v65;
goto LABEL_112;
}
}
v6 = 1;
v65 = 1;
}
LABEL_112:
if( v6 )
break;
}
}
}
v8 = IsSameUser;
if( ++v38 >= ObjectEvent[19] )
goto LABEL_57;
}
LABEL_74:
LOBYTE(EvaluateFilter) = v65;
}
LABEL_13:
if( !*(_DWORD *)(*((_QWORD *)Query + 3) + 20i64) && (ObjectEvent[1] & 8) != 0 )
{
v7 = 1;
}
else
{
v16 = 0;
v7 = 0;
do
{
if( v16 >= ObjectEvent[19] )
break;
v17 = *((_QWORD *)Query + 3);
v18 = 0;
v19 = 8i64 * v16;
if( *(_DWORD *)(v17 + 80) )
{
while( 1 )
{
v20 = *(_QWORD *)(v17 + 88);
v21 = 56i64 * v18;
if( *(_DWORD *)(v21 + v20 + 24) == ObjectEvent[v19 + 24] )
{
v34 = *(_QWORD *)(v21 + v20 + 8) - *(_QWORD *)&ObjectEvent[v19 + 20];
if( !v34 )
v34 = *(_QWORD *)(v21 + v20 + 16) - *(_QWORD *)&ObjectEvent[v19 + 22];
if( !v34 && *(_DWORD *)(v21 + v20 + 28) == ObjectEvent[v19 + 25] )
{
v35 = *(const wchar_t **)(v21 + v20 + 32);
v36 = *(const wchar_t **)&ObjectEvent[v19 + 26];
if( (v35 == v36 || v35 && v36 && !wcsicmp(v35, v36)) && (ObjectEvent[v19 + 25] != 1 || IsSameUser) )
break;
}
}
v17 = *((_QWORD *)Query + 3);
if( ++v18 >= *(_DWORD *)(v17 + 80) )
goto LABEL_20;
}
v7 = 1;
}
LABEL_20:
++v16;
}
while( !v7 );
}
v22 = (_BYTE)EvaluateFilter == 0;
EvaluateFilter = Matched;
if( v22 && !v7 )
goto LABEL_23;
LABEL_25:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Query + 8, 0i64);
Buffer[0] = *((_QWORD *)ObjectEvent + 1);
v24 = RtlLookupElementGenericTableAvl((_RTL_AVL_TABLE *)(Query + 18), Buffer) != 0i64;
ExReleasePushLockEx((_DWORD)Query + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v25 = ObjectEvent[1];
if( (v25 & 2) != 0 )
{
if( !v24 )
{
v27 = 0;
v28 = DevQueryResultStateChange;
goto LABEL_32;
}
LABEL_87:
v47 = (_ETHREAD *)KeGetCurrentThread();
v28 = DevQueryResultRemove;
v27 = 1;
--v47->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Query + 8, 0i64);
PiDqQueryDeleteObjectFromResultSet(Query, *((_QWORD *)ObjectEvent + 1));
ExReleasePushLockEx((_DWORD)Query + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
goto LABEL_32;
}
if( (v25 & 1) == 0 && !v7 )
{
v26 = v24;
goto LABEL_29;
}
v41 = *((_QWORD *)Query + 3);
v42 = *(_DWORD *)(v41 + 20);
if( !v42 )
{
v26 = 1;
LABEL_61:
v43 = v26;
LOBYTE(Matched) = v26;
LABEL_62:
if( !v43 )
goto LABEL_30;
goto LABEL_63;
}
v55 = v42 - 1;
if( !v55 )
{
v26 = wcsicmp(*(const wchar_t **)(v41 + 24), *(const wchar_t **)(*((_QWORD *)ObjectEvent + 1) + 16i64)) == 0;
goto LABEL_61;
}
if( v55 != 1 )
goto LABEL_30;
v56 = *(const wchar_t **)(v41 + 32);
v26 = 0;
LOBYTE(Matched) = 0;
if( !*v56 )
goto LABEL_30;
v43 = 0;
while( !v43 )
{
v26 = wcsicmp(v56, *(const wchar_t **)(*((_QWORD *)ObjectEvent + 1) + 16i64)) == 0;
v57 = -1i64;
v43 = v26;
LOBYTE(Matched) = v26;
do
++v57;
while( v56[v57] );
v56 += v57 + 1;
if( !*v56 )
goto LABEL_62;
}
LABEL_63:
if( !*(_DWORD *)(*((_QWORD *)Query + 3) + 20i64) )
{
v44 = PiPnpRtlApplyMandatoryFilters(
*(&stru_140CF2E80 + 607),
*(WCHAR **)(*((_QWORD *)ObjectEvent + 1) + 16i64),
*(_DWORD *)(*((_QWORD *)ObjectEvent + 1) + 28i64),
0i64,
(_SECURITY_SUBJECT_CONTEXT *)Query + 1,
(UINT8 *)&Matched);
EvaluateFilter = v44;
if( v44 == -1073741772 || v44 == -1073741275 )
{
v26 = 0;
EvaluateFilter = 0;
LOBYTE(Matched) = 0;
}
else
{
v26 = Matched;
}
if( EvaluateFilter < 0 )
goto LABEL_139;
}
if( !v26 )
goto LABEL_30;
if( *(_QWORD *)(*((_QWORD *)Query + 3) + 88i64) )
{
EvaluateFilter = PiDqQueryEvaluateFilter(
Query,
*(WCHAR **)(*((_QWORD *)ObjectEvent + 1) + 16i64),
(UINT8 *)&Matched);
if( EvaluateFilter == -1073741772 )
{
v26 = 0;
EvaluateFilter = 0;
}
else
{
v26 = Matched;
}
if( EvaluateFilter < 0 )
goto LABEL_139;
}
LABEL_29:
if( v26 )
{
if( v24 )
{
v28 = DevQueryResultUpdate;
v27 = v65 != 0;
}
else
{
v48 = (_ETHREAD *)KeGetCurrentThread();
v28 = DevQueryResultAdd;
--v48->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Query + 8, 0i64);
EvaluateFilter = PiDqQueryAddObjectToResultSet(Query, *((PI_DM_OBJECT **)ObjectEvent + 1));
ExReleasePushLockEx((_DWORD)Query + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v27 = 1;
}
goto LABEL_32;
}
LABEL_30:
if( v24 )
goto LABEL_87;
v27 = 0;
v28 = DevQueryResultStateChange;
LABEL_32:
if( EvaluateFilter < 0 )
goto LABEL_139;
if( v27 )
{
PiDqQueryActionQueueEntryCreate(
v28,
*((_PI_DM_OBJECT **)ObjectEvent + 1),
ObjectEvent,
&Entry,
(INT64)SecuritySubjectContext,
(INT64)v60,
v61,
(INT64)Entry,
Buffer[0],
Buffer[1],
*(INT64 *)savedregs,
*(INT64 *)&savedregs[8],
*(INT64 *)&savedregs[16],
*(INT64 *)&savedregs[24],
*(INT64 *)&savedregs[32],
*(INT64 *)&savedregs[40],
*(UINT64 *)&savedregs[48]);
EvaluateFilter = v29;
if( v29 < 0 )
goto LABEL_139;
v30 = (_ETHREAD *)KeGetCurrentThread();
--v30->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Query + 8, 0i64);
PiDqQueryAppendActionEntry(Query);
ExReleasePushLockEx((_DWORD)Query + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
LABEL_23:
if( EvaluateFilter < 0 )
{
LABEL_139:
v58 = (_ETHREAD *)KeGetCurrentThread();
--v58->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Query + 8, 0i64);
Query[54] |= 1u;
PiDqQueryFreeActiveData(Query);
ExReleasePushLockEx((_DWORD)Query + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
}Referenced by:
PiDqObjectManagerServiceActionQueue