PnpAddVetoInformation
VOID **__fastcall PnpAddVetoInformation(PVOID Object, _QWORD *a2, unsigned int a3){
VOID **v3;
VOID **v4;
VOID **v5;
VOID **v6;
char v9;
__int64 v10;
VOID **result;
PVOID *v12;
VOID **v13;
VOID **v14;
VOID ***v15;
VOID **v16;
VOID ***v17;
v3 = (VOID **)*a2;
v4 = (VOID **)a2;
v5 = 0i64;
v6 = 0i64;
v9 = 1;
v10 = *a2 - 24i64;
if( v4 == v3 )
goto LABEL_15;
while( 1 )
{
if( *(_DWORD *)(v10 + 16) == a3 )
{
result = *(VOID ***)v10;
v6 = (VOID **)v10;
v9 = 0;
while( 1 )
{
v12 = result - 1;
if( (VOID **)v10 == result )
goto LABEL_11;
if( *v12 == Object )
return result;
if( *v12 > Object )
{
v6 = result;
goto LABEL_11;
}
result = (VOID **)*result;
}
}
if( *(_DWORD *)(v10 + 16) > a3 )
break;
LABEL_11:
v13 = *(VOID ***)(v10 + 24);
v10 = (__int64)(v13 - 3);
if( v4 == v13 )
goto LABEL_14;
}
v4 = (VOID **)(v10 + 24);
LABEL_14:
if( v9 )
{
LABEL_15:
result = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1332768336i64);
v5 = result;
if( result )
{
*((_DWORD *)result + 4) = a3;
v14 = result + 3;
v15 = (VOID ***)v4[1];
if( *v15 == v4 )
{
*v14 = v4;
v6 = v5;
v14[1] = v15;
*v15 = v14;
v4[1] = v14;
v5[1] = v5;
*v5 = v5;
goto LABEL_18;
}
LABEL_24:
__fastfail(3u);
}
}
else
{
LABEL_18:
result = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1349545552i64);
v16 = result;
if( result )
{
ObfReferenceObject(Object);
*v16 = Object;
result = v16 + 1;
v17 = (VOID ***)v6[1];
if( *v17 != v6 )
goto LABEL_24;
*result = v6;
v16[2] = v17;
*v17 = result;
v6[1] = result;
}
else if( v5 )
{
return(VOID **)ExFreePoolWithTag(v5, 0x4F706E50u);
}
}
return result;
}Referenced by:
PnpCollectOpenHandlesCallBack