PiPnpRtlInit
NTSTATUS __stdcall PiPnpRtlInit(UINT64 Phase){
unsigned int v1;
NTSTATUS v2;
__int64 v4;
__int64 v5;
WCHAR v6;
INT64 v7;
INT64 v8;
INT64 v9;
INT64 v10;
INT64 v11;
INT64 v12;
INT64 v13;
HPNPCTX *v14;
INT64 v15;
INT64 v16;
int DesiredAccess;
UINT64 DesiredAccessa;
INT64 DesiredAccessb;
int phkResult;
VOID **phkResulta;
INT64 a7;
INT64 v23;
NTSTATUS v24;
INT64 a5;
v24 = 0;
v1 = Phase;
a5 = 0i64;
if( (_DWORD)Phase )
return PiDrvDbInit(v1);
*(&PnpReplaceEvent + 429) = (char *)&PnpReplaceEvent + 3424;
*(&PnpReplaceEvent + 428) = (char *)&PnpReplaceEvent + 3424;
v2 = ExInitializeResourceLite((INT64)&PnpReplaceEvent + 3456);
if( v2 >= 0 )
{
v2 = ExInitializeResourceLite((INT64)&PnpReplaceEvent + 3584);
if( v2 >= 0 )
{
v2 = PnpCtxOpenMachine(v4, 0i64, v5, 0i64, DesiredAccess, phkResult, (_QWORD *)&stru_140CF2E80 + 607);
if( v2 >= 0 )
{
if( !CmIsStateSeparationEnabled()
|| (LODWORD(DesiredAccessa) = 0x2000000,
PnpCtxRegOpenKey(
*(&stru_140CF2E80 + 607),
(VOID *)0x80000002i64,
(WCHAR *)L"DEVICES",
0i64,
DesiredAccessa,
(VOID **)&a5) < 0)
|| (v2 = PnpCtxRegisterMachineNode(v12, (WCHAR *)L"DEVICES", 2i64, v13, a5),
PnpCtxRegCloseKey(v14, (VOID *)a5, v15, v16, DesiredAccessb, (INT64)phkResulta, a7, v23),
v2 >= 0) )
{
v2 = PiDrvDbEnumDriverStoreNodes(
(unsigned __int8(__fastcall *)(_QWORD, __int64))PiPnpRtlRegisterDriverMachineNodeCallback,
(__int64)&v24,
v6);
if( v2 >= 0 )
{
v2 = v24;
if( v24 >= 0 )
{
v2 = PnpCtxSetNtPlugPlayRoutine(v7, 1i64, (INT64)PiPnpRtlGetDeviceNtPropertyRoutine);
if( v2 >= 0 )
{
v2 = PnpCtxSetNtPlugPlayRoutine(v8, 2i64, (INT64)PiPnpRtlGetDeviceStatus);
if( v2 >= 0 )
{
v2 = PnpCtxSetNtPlugPlayRoutine(v9, 3i64, (INT64)PiPnpRtlGetDeviceRelatedDeviceRoutine);
if( v2 >= 0 )
{
v2 = PnpCtxSetNtPlugPlayRoutine(v10, 4i64, (INT64)PiPnpRtlGetDeviceRelationsList);
if( v2 >= 0 )
{
v2 = PnpCtxSetNtPlugPlayRoutine(v11, 5i64, (INT64)PiPnpRtlGetDeviceInterfaceEnabled);
if( v2 >= 0 )
{
_InterlockedExchange64(
(volatile __int64 *)(*(&stru_140CF2E80 + 607) + 488i64),
(__int64)PiPnpRtlObjectActionCallback);
_InterlockedExchange64(
(volatile __int64 *)(*(&stru_140CF2E80 + 607) + 504i64),
(__int64)PiPnpRtlCmActionCallback);
_InterlockedExchange64(
(volatile __int64 *)(*(&stru_140CF2E80 + 607) + 496i64),
(__int64)PiPnpRtlObjectEventCallback);
return PiDrvDbInit(v1);
}
}
}
}
}
}
}
}
}
}
}
return v2;
}Referenced by:
IopInitializePlugPlayServices
PnpBootPhaseComplete