PiControlQueryConflictList

VOID __stdcall PiControlQueryConflictList(){
  unsigned __int16 *v0; 
  INT8 CallerMode; 
  VOID **v2; 
  bool v3; 
  INT8 v4; 
  unsigned __int16 *v5; 
  _DWORD *v6; 
  UINT64 v7; 
  VOID *v8; 
  _DEVICE_OBJECT *v9; 
  int UserModeCallersCopy; 
  _DEVICE_OBJECT *v11; 
  __int64 v12; 
  _DWORD *DeviceNode; 
  NTSTATUS v14; 
  VOID *Src; 
  VOID *Srca; 
  VOID *Srcb; 
  VOID *Destination; 
  PVOID Buffer[2]; 
  VOID *Dest; 

  v2 = (VOID **)(v0 + 16);
  v3 = *((_QWORD *)v0 + 4) == 0i64;
  v4 = CallerMode;
  v5 = v0;
  *(_OWORD *)Buffer = 0i64;
  if( !v3 && *((_DWORD *)v0 + 10) >= 0x20u )
  {
    v6 = (_DWORD *)*((_QWORD *)v0 + 2);
    if( v6 )
    {
      v7 = *((unsigned int *)v5 + 6);
      if( (unsigned int)v7 >= 0x28 && *v6 == 1 && v6[4] == 1 )
      {
        WORD1(Buffer[0]) = *v5;
        LOWORD(Buffer[0]) = WORD1(Buffer[0]);
        if( (unsigned __int16)(WORD1(Buffer[0]) - 1) <= 0x18Fu && (BYTE2(Buffer[0]) & 1) == 0 )
        {
          Destination = 0i64;
          LODWORD(Src) = 1;
          v8 = 0i64;
          v9 = 0i64;
          Dest = 0i64;
          Buffer[1] = 0i64;
          UserModeCallersCopy = PiControlMakeUserModeCallersCopy(&Destination, v6, v7, 1ui64, CallerMode, (UINT64)Src);
          if( UserModeCallersCopy >= 0 )
          {
            UserModeCallersCopy = PiControlAllocateBufferForUserModeCaller(&Dest, *((unsigned int *)v5 + 10), v4, *v2);
            if( UserModeCallersCopy < 0
              || (LODWORD(Srca) = 1,
                  UserModeCallersCopy = PiControlMakeUserModeCallersCopy(
                                          &Buffer[1],
                                          *((VOID **)v5 + 1),
                                          *v5,
                                          2ui64,
                                          v4,
                                          (UINT64)Srca),
                  UserModeCallersCopy < 0) )
            {
              v8 = Dest;
            }
            else
            {
              UserModeCallersCopy = -1073741810;
              PpDevNodeLockTree(PPL_TREEOP_ALLOW_READS);
              v11 = (_DEVICE_OBJECT *)PnpDeviceObjectFromDeviceInstanceWithTag((__int64)Buffer, 0x43706E50u);
              v8 = Dest;
              v9 = v11;
              if( v11 )
              {
                DeviceNode = v11->DeviceObjectExtension->DeviceNode;
                if( DeviceNode )
                {
                  if( DeviceNode != (_DWORD *)*(&PnpReplaceEvent + 831) && (unsigned int)(DeviceNode[75] - 787) > 1 )
                  {
                    LODWORD(Srcb) = 0;
                    UserModeCallersCopy = IopQueryConflictList(
                                            v9,
                                            (__int64)Destination,
                                            v12,
                                            Dest,
                                            *((_DWORD *)v5 + 10));
                    v14 = PiControlMakeUserModeCallersCopy(v2, v8, *((unsigned int *)v5 + 10), 1ui64, v4, (UINT64)Srcb);
                    if( v14 < 0 )
                      UserModeCallersCopy = v14;
                  }
                }
              }
              PpDevNodeUnlockTree(PPL_TREEOP_ALLOW_READS);
            }
          }
          PiControlFreeUserModeCallersBuffer(v4, Destination);
          PiControlFreeUserModeCallersBuffer(v4, v8);
          PiControlFreeUserModeCallersBuffer(v4, Buffer[1]);
          if( v9 )
            ObfDereferenceObjectWithTag(v9, 0x43706E50ui64);
          *((_DWORD *)v5 + 12) = UserModeCallersCopy;
        }
      }
    }
  }
}

Referenced by: