PiEventBuildPdoList

__int64 __fastcall PiEventBuildPdoList(
        _RELATION_LIST *List,
        int a2,
        __int64 a3,
        _DWORD *a4,
        __int64 a5,
        _RELATION_LIST_MARKER Marker,
        __int64 a7){
  _BYTE *v7; 
  unsigned int v8; 
  _BYTE *v9; 
  _DEVICE_OBJECT_LIST *DeviceObjectList; 
  VOID **CriticalMemory; 
  _DEVICE_OBJECT *v16; 
  char *DeviceNode; 
  int v18; 
  __int64 v19; 
  __int64 result; 
  int v21; 
  _DEVICE_OBJECT *DeviceObject; 
  _DEVICE_RELATION_LEVEL RelationLevel; 

  v7 = (_BYTE *)Marker;
  v8 = 0;
  v9 = (_BYTE *)a7;
  DeviceObject = 0i64;
  RelationLevel = RELATION_LEVEL_REMOVE_EJECT;
  DeviceObjectList = List->DeviceObjectList;
  *(_BYTE *)Marker.Mode = 0;
  *v9 = 0;
  CriticalMemory = PnpAllocateCriticalMemory(a2, NonPagedPoolNx, 8i64 * DeviceObjectList->Count, 0x4E706E50u);
  if( CriticalMemory )
  {
    *a4 = 0;
    Marker = (_RELATION_LIST_MARKER)1i64;
    while( 1 )
    {
      do
      {
        if( !IopEnumerateRelations(List, &Marker, &DeviceObject, &RelationLevel, 0i64) )
          goto LABEL_14;
      }
      while( RelationLevel == RELATION_LEVEL_REMOVE_EJECT && a2 != 4 && a2 );
      v16 = DeviceObject;
      if( DeviceObject )
        DeviceNode = (char *)DeviceObject->DeviceObjectExtension->DeviceNode;
      else
        DeviceNode = 0i64;
      if( a2 == 2 )
        goto LABEL_12;
      if( a2 )
        break;
LABEL_18:
      if( (*((_DWORD *)DeviceNode + 99) & 0x1000) != 0 )
      {
        v21 = 1;
        goto LABEL_25;
      }
      if( *((_DWORD *)DeviceNode + 75) == 785 )
      {
        v21 = 5;
LABEL_25:
        PnpFinalizeVetoedRemove(a3, v21, (_UNICODE_STRING *)(DeviceNode + 40));
        v8 = -2147483608;
        goto LABEL_14;
      }
LABEL_13:
      v19 = (unsigned int)*a4;
      CriticalMemory[v19] = v16;
      *a4 = v19 + 1;
    }
    v18 = *((_DWORD *)DeviceNode + 142);
    if( v18 == 1 )
    {
      *v7 = 1;
    }
    else if( v18 )
    {
      *v9 = 1;
    }
LABEL_12:
    if( (a2 & 0xFFFFFFFB) != 0 )
      goto LABEL_13;
    goto LABEL_18;
  }
  v8 = -1073741670;
LABEL_14:
  result = v8;
  *(_QWORD *)a5 = CriticalMemory;
  return result;
}

Referenced by:

PnpProcessQueryRemoveAndEject