PnpAddVetoInformation

VOID **__fastcall PnpAddVetoInformation(PVOID Object, _QWORD *a2, unsigned int a3){
  VOID **v3; 
  VOID **v4; 
  VOID **v5; 
  VOID **v6; 
  char v9; 
  __int64 v10; 
  VOID **result; 
  PVOID *v12; 
  VOID **v13; 
  VOID **v14; 
  VOID ***v15; 
  VOID **v16; 
  VOID ***v17; 

  v3 = (VOID **)*a2;
  v4 = (VOID **)a2;
  v5 = 0i64;
  v6 = 0i64;
  v9 = 1;
  v10 = *a2 - 24i64;
  if( v4 == v3 )
    goto LABEL_15;
  while( 1 )
  {
    if( *(_DWORD *)(v10 + 16) == a3 )
    {
      result = *(VOID ***)v10;
      v6 = (VOID **)v10;
      v9 = 0;
      while( 1 )
      {
        v12 = result - 1;
        if( (VOID **)v10 == result )
          goto LABEL_11;
        if( *v12 == Object )
          return result;
        if( *v12 > Object )
        {
          v6 = result;
          goto LABEL_11;
        }
        result = (VOID **)*result;
      }
    }
    if( *(_DWORD *)(v10 + 16) > a3 )
      break;
LABEL_11:
    v13 = *(VOID ***)(v10 + 24);
    v10 = (__int64)(v13 - 3);
    if( v4 == v13 )
      goto LABEL_14;
  }
  v4 = (VOID **)(v10 + 24);
LABEL_14:
  if( v9 )
  {
LABEL_15:
    result = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1332768336i64);
    v5 = result;
    if( result )
    {
      *((_DWORD *)result + 4) = a3;
      v14 = result + 3;
      v15 = (VOID ***)v4[1];
      if( *v15 == v4 )
      {
        *v14 = v4;
        v6 = v5;
        v14[1] = v15;
        *v15 = v14;
        v4[1] = v14;
        v5[1] = v5;
        *v5 = v5;
        goto LABEL_18;
      }
LABEL_24:
      __fastfail(3u);
    }
  }
  else
  {
LABEL_18:
    result = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1349545552i64);
    v16 = result;
    if( result )
    {
      ObfReferenceObject(Object);
      *v16 = Object;
      result = v16 + 1;
      v17 = (VOID ***)v6[1];
      if( *v17 != v6 )
        goto LABEL_24;
      *result = v6;
      v16[2] = v17;
      *v17 = result;
      v6[1] = result;
    }
    else if( v5 )
    {
      return(VOID **)ExFreePoolWithTag(v5, 0x4F706E50u);
    }
  }
  return result;
}

Referenced by:

PnpCollectOpenHandlesCallBack