PoGetLightestSystemStateForEject
NTSTATUS __stdcall PoGetLightestSystemStateForEject(
UINT8 DockBeingEjected,
UINT8 HotEjectSupported,
UINT8 WarmEjectSupported,
_SYSTEM_POWER_STATE *LightestSleepState,
INT64 a5,
INT64 a6,
INT64 a7){
UINT8 v9;
NTSTATUS result;
int v11;
NTSTATUS v12;
unsigned int v13;
UINT64 Length;
UINT64 Lengtha;
UINT64 ResultLength;
PVOID Handle;
_UNICODE_STRING DestinationString;
__int128 KeyValueInformation;
__int128 v20;
__int128 OutputBuffer[2];
Handle = 0i64;
LODWORD(ResultLength) = 0;
*LightestSleepState = PowerSystemUnspecified;
v9 = HotEjectSupported;
memset(OutputBuffer, 0, sizeof(OutputBuffer));
DestinationString = 0i64;
KeyValueInformation = 0i64;
v20 = 0i64;
if( !HotEjectSupported && !WarmEjectSupported )
v9 = 1;
if( !DockBeingEjected )
{
*LightestSleepState = 2 - (v9 != 0);
return 0;
}
result = PopOpenPowerKey(&Handle);
if( result >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"UndockPowerPolicy");
LODWORD(Length) = 32;
v11 = ZwQueryValueKey(
Handle,
&DestinationString,
KeyValuePartialInformation,
&KeyValueInformation,
Length,
&ResultLength);
ZwClose((_HANDLE)Handle);
if( v11 >= 0 )
{
if( DWORD2(KeyValueInformation) < 8 )
return -1073741492;
if( HIDWORD(KeyValueInformation) != 1 )
return -1073741823;
if( DWORD2(KeyValueInformation) < 0x10 || (_DWORD)v20 != DWORD2(KeyValueInformation) )
return -1073741492;
}
else
{
if( v11 != -1073741772 )
return v11;
*(_QWORD *)((char *)&v20 + 4) = 10i64;
}
LODWORD(Lengtha) = 32;
result = ZwPowerInformation(SystemBatteryState, 0i64, 0i64, OutputBuffer, Lengtha);
v12 = result;
if( result >= 0 )
{
if( DWORD2(OutputBuffer[0]) && (unsigned int)(100 * HIDWORD(OutputBuffer[0])) > HIDWORD(OutputBuffer[0]) )
v13 = (unsigned int)(100 * HIDWORD(OutputBuffer[0])) / DWORD2(OutputBuffer[0]);
else
v13 = 0;
if( v13 >= DWORD1(v20) && v9 )
{
*LightestSleepState = PowerSystemWorking;
}
else if( WarmEjectSupported )
{
*LightestSleepState = v13 < DWORD2(v20) ? PowerSystemHibernate : PowerSystemSleeping1;
}
else
{
return -1073741090;
}
return v12;
}
}
return result;
}Referenced by:
PnpProcessQueryRemoveAndEject