PiUEventHandleVetoEvent

NTSTATUS __stdcall PiUEventHandleVetoEvent(
        _FILE_OBJECT *FileObject,
        VOID *Buffer,
        UINT64 InputBufferLength,
        _IO_STATUS_BLOCK *IoStatus,
        _IO_STATUS_BLOCK *IoStatusa){
  char *FsContext2; 
  int AllocatedFullProcessImageName; 
  _EPROCESS *v7; 
  _UNICODE_STRING *v8; 
  char v9; 
  __int64 v10; 
  _FAST_MUTEX *v11; 
  char *v12; 
  __int64 v14; 
  _DWORD *v15; 
  __int64 v16; 
  NTSTATUS v17; 
  UINT8 *ProcessImageFileName; 
  _UNICODE_STRING *ImageName; 
  _STRING DestinationString; 
  _UNICODE_STRING v21; 
  _EPROCESS *Process; 

  FsContext2 = (char *)FileObject->FsContext2;
  Process = 0i64;
  ImageName = 0i64;
  AllocatedFullProcessImageName = 0;
  v7 = 0i64;
  v8 = 0i64;
  v9 = 0;
  v21 = 0i64;
  if( FsContext2 && Buffer && (_DWORD)InputBufferLength == 8 )
  {
    v10 = *(_QWORD *)Buffer;
    v11 = (_FAST_MUTEX *)*((_QWORD *)FsContext2 + 2);
    *(_QWORD *)&DestinationString.Length = *(_QWORD *)Buffer;
    KeAcquireGuardedMutex(v11);
    v12 = (char *)*((_QWORD *)FsContext2 + 12);
    if( v12 == FsContext2 + 96 )
    {
      AllocatedFullProcessImageName = -1073741811;
      KeReleaseGuardedMutex(*((PKGUARDED_MUTEX *)FsContext2 + 2));
      goto LABEL_11;
    }
    if( *(_BYTE *)(*((_QWORD *)v12 + 3) + 69i64) )
    {
      KeAcquireGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 7776));
      v14 = *((_QWORD *)v12 + 3);
      v15 = *(_DWORD **)(v14 + 32);
      if( v15 )
      {
        v16 = *(_QWORD *)(v14 + 40);
        if( v16 )
        {
          if( !*v15 )
          {
            if( (_BYTE)v10 )
            {
              *v15 = *(_DWORD *)(&DestinationString.MaximumLength + 1);
              v17 = PsLookupProcessByProcessId(*((VOID **)FsContext2 + 6), &Process);
              v7 = Process;
              if( v17 < 0
                || (AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageName(Process, &ImageName),
                    AllocatedFullProcessImageName < 0) )
              {
                v8 = &v21;
                RtlInitUnicodeString(&v21, (PCWSTR)&dword_1407CF120);
                AllocatedFullProcessImageName = 0;
              }
              else
              {
                v8 = ImageName;
                if( !ImageName->Length )
                {
                  v9 = 1;
                  DestinationString = 0i64;
                  ExFreePoolWithTag(ImageName, 0);
                  v8 = &v21;
                  ProcessImageFileName = PsGetProcessImageFileName(v7);
                  RtlInitAnsiString(&DestinationString, (PCSZ)ProcessImageFileName);
                  RtlAnsiStringToUnicodeString(&v21, &DestinationString, 1u);
                }
              }
              if( v8->Length > 0x400u )
              {
                AllocatedFullProcessImageName = RtlStringCchCopyNW(
                                                  *(WCHAR **)(*(_QWORD *)(*((_QWORD *)v12 + 3) + 40i64) + 8i64),
                                                  0x200ui64,
                                                  v8->Buffer,
                                                  0x1FFui64);
                *(_WORD *)(*(_QWORD *)(*(_QWORD *)(*((_QWORD *)v12 + 3) + 40i64) + 8i64) + 1022i64) = 0;
                **(_WORD **)(*((_QWORD *)v12 + 3) + 40i64) = 1024;
              }
              else
              {
                RtlCopyUnicodeString(*(PUNICODE_STRING *)(*((_QWORD *)v12 + 3) + 40i64), v8);
              }
              KeSetEvent(*(PRKEVENT *)(*((_QWORD *)v12 + 3) + 24i64), 0, 0);
            }
            else
            {
              **(_WORD **)(v16 + 8) = 0;
              **(_WORD **)(v14 + 40) = 0;
              **(_DWORD **)(v14 + 32) = 0;
            }
          }
        }
      }
      KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 7776));
    }
    PiUEventDequeuePendingEventWorker((__int64)FsContext2, v12, 1);
    KeReleaseGuardedMutex(*((PKGUARDED_MUTEX *)FsContext2 + 2));
  }
  else
  {
    AllocatedFullProcessImageName = -1073741811;
  }
  if( v9 )
  {
    RtlFreeAnsiString(v8);
  }
  else if( v8 && v8 != &v21 )
  {
    ExFreePoolWithTag(v8, 0);
  }
  if( v7 )
    ObfDereferenceObjectWithTag(v7, 0x746C6644ui64);
LABEL_11:
  IoStatusa->Information = 0i64;
  return AllocatedFullProcessImageName;
}

Referenced by: