PiPnpRtlGatherDeviceDeleteInfo
NTSTATUS __stdcall PiPnpRtlGatherDeviceDeleteInfo(WCHAR *DeviceId, ULONG_PTR *Info){
VOID **PoolWithTag;
UINT8 *v5;
NTSTATUS v6;
int DeviceRegProp;
UINT8 *v8;
UINT64 Flags;
_UNICODE_STRING DestinationString;
_UNICODE_STRING PnPControlData;
__int64 v13;
__int64 v14;
__int64 v15;
UINT64 CmRegPropType;
UINT64 PropertySize;
LODWORD(CmRegPropType) = 0;
DestinationString = 0i64;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x54ui64, 1198550608i64);
*(_QWORD *)Info = PoolWithTag;
if( !PoolWithTag )
{
DeviceRegProp = -1073741670;
LABEL_19:
*(_QWORD *)Info = 0i64;
return DeviceRegProp;
}
memset(PoolWithTag, 0i64, 0x54u);
RtlInitUnicodeString(&DestinationString, DeviceId);
v5 = *(UINT8 **)Info;
if( *(_QWORD *)Info )
{
v15 = 0i64;
v13 = 0i64;
v14 = 0i64;
PnPControlData = DestinationString;
v6 = ZwPlugPlayControl(PlugPlayControlDeviceStatus, &PnPControlData, 0x28ui64);
if( v6 >= 0 )
*(_DWORD *)v5 = v14;
v5 = *(UINT8 **)Info;
}
else
{
v6 = -1073741811;
}
if( v6 < 0 )
{
v5 = *(UINT8 **)Info;
**(_DWORD **)Info = 45;
}
LODWORD(Flags) = 0;
LODWORD(PropertySize) = 78;
DeviceRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
DeviceId,
0i64,
9i64,
&CmRegPropType,
v5 + 4,
&PropertySize,
Flags);
if( DeviceRegProp >= 0 && (_DWORD)CmRegPropType == 1 && (unsigned int)PropertySize > 2 )
{
v8 = *(UINT8 **)Info;
*(_WORD *)(*(_QWORD *)Info + 80i64) = 0;
}
else
{
v8 = *(UINT8 **)Info;
DeviceRegProp = 0;
*(_WORD *)(*(_QWORD *)Info + 4i64) = 0;
}
if( DeviceRegProp < 0 )
{
if( v8 )
ExFreePoolWithTag(v8, 0x47706E50u);
goto LABEL_19;
}
return DeviceRegProp;
}Referenced by:
PiPnpRtlCmActionCallback