PiEventBuildPdoList
__int64 __fastcall PiEventBuildPdoList(
_RELATION_LIST *List,
int a2,
__int64 a3,
_DWORD *a4,
__int64 a5,
_RELATION_LIST_MARKER Marker,
__int64 a7){
_BYTE *v7;
unsigned int v8;
_BYTE *v9;
_DEVICE_OBJECT_LIST *DeviceObjectList;
VOID **CriticalMemory;
_DEVICE_OBJECT *v16;
char *DeviceNode;
int v18;
__int64 v19;
__int64 result;
int v21;
_DEVICE_OBJECT *DeviceObject;
_DEVICE_RELATION_LEVEL RelationLevel;
v7 = (_BYTE *)Marker;
v8 = 0;
v9 = (_BYTE *)a7;
DeviceObject = 0i64;
RelationLevel = RELATION_LEVEL_REMOVE_EJECT;
DeviceObjectList = List->DeviceObjectList;
*(_BYTE *)Marker.Mode = 0;
*v9 = 0;
CriticalMemory = PnpAllocateCriticalMemory(a2, NonPagedPoolNx, 8i64 * DeviceObjectList->Count, 0x4E706E50u);
if( CriticalMemory )
{
*a4 = 0;
Marker = (_RELATION_LIST_MARKER)1i64;
while( 1 )
{
do
{
if( !IopEnumerateRelations(List, &Marker, &DeviceObject, &RelationLevel, 0i64) )
goto LABEL_14;
}
while( RelationLevel == RELATION_LEVEL_REMOVE_EJECT && a2 != 4 && a2 );
v16 = DeviceObject;
if( DeviceObject )
DeviceNode = (char *)DeviceObject->DeviceObjectExtension->DeviceNode;
else
DeviceNode = 0i64;
if( a2 == 2 )
goto LABEL_12;
if( a2 )
break;
LABEL_18:
if( (*((_DWORD *)DeviceNode + 99) & 0x1000) != 0 )
{
v21 = 1;
goto LABEL_25;
}
if( *((_DWORD *)DeviceNode + 75) == 785 )
{
v21 = 5;
LABEL_25:
PnpFinalizeVetoedRemove(a3, v21, (_UNICODE_STRING *)(DeviceNode + 40));
v8 = -2147483608;
goto LABEL_14;
}
LABEL_13:
v19 = (unsigned int)*a4;
CriticalMemory[v19] = v16;
*a4 = v19 + 1;
}
v18 = *((_DWORD *)DeviceNode + 142);
if( v18 == 1 )
{
*v7 = 1;
}
else if( v18 )
{
*v9 = 1;
}
LABEL_12:
if( (a2 & 0xFFFFFFFB) != 0 )
goto LABEL_13;
goto LABEL_18;
}
v8 = -1073741670;
LABEL_14:
result = v8;
*(_QWORD *)a5 = CriticalMemory;
return result;
}Referenced by:
PnpProcessQueryRemoveAndEject