PiCMQueryRemove
NTSTATUS __stdcall PiCMQueryRemove(
VOID *IoctlInputBuffer,
UINT64 IoctlInputBufferSize,
VOID *IoctlOutputBuffer,
UINT64 IoctlOutputBufferSize,
UINT64 *BytesUsed){
unsigned int v5;
WCHAR *v6;
char v7;
unsigned int v8;
VOID **v9;
WCHAR *v10;
int v11;
__int64 v12;
int v13;
int DeviceRegProp;
unsigned int v15;
unsigned int v16;
VOID **PoolWithTag;
int v18;
NTSTATUS v19;
unsigned int v21;
int v22;
UINT64 BufferSize;
UINT64 ExpectedOutputSize;
VOID *IoctlOutputBuffera;
UINT64 IoctlOutputBufferSizea;
char ClientInteractive[4];
UINT64 RequiredSize;
UINT64 DeviceStatus;
UINT8 PropertyBuffer[4];
UINT64 SessionId;
UINT64 DeviceProblem;
_CMAPI_INPUT_OBJECT_DATA v33[4];
WCHAR *SourceString[2];
UINT64 v35;
_UNICODE_STRING DestinationString[4];
int v38;
UINT64 *BytesUseda;
v38 = IoctlOutputBufferSize;
LODWORD(DeviceStatus) = 0;
LODWORD(DeviceProblem) = 0;
v35 = 0i64;
v5 = IoctlOutputBufferSize;
DestinationString[0] = 0i64;
HIDWORD(SessionId) = 0;
v6 = 0i64;
*(_OWORD *)v33 = 0i64;
*(_DWORD *)BytesUseda = 0;
v7 = 0;
*(_OWORD *)SourceString = 0i64;
*(_DWORD *)PropertyBuffer = 0;
v8 = 0;
HIDWORD(DeviceStatus) = 0;
v9 = 0i64;
HIDWORD(DeviceProblem) = 0;
ClientInteractive[0] = 0;
LODWORD(SessionId) = 0;
RequiredSize = 0i64;
v11 = PiCMCaptureObjectInputData(
IoctlInputBuffer,
IoctlInputBufferSize,
(_CMAPI_INPUT_OBJECT_DATA *)(unsigned int)BytesUsed);
if( v11 < 0 )
goto LABEL_26;
v6 = SourceString[0];
v13 = HIDWORD(SourceString[1]);
if( (byte_140C130BB & 4) != 0 )
McTemplateK0dz_EtwWriteTransfer(
(__int64)v10,
(const _EVENT_DESCRIPTOR *)KMPnPEvt_CfgMgr_QueryRemove_Start,
v12,
SHIDWORD(SourceString[1]),
SourceString[0]);
if( !SourceString[0] || v33[2] != 1 )
{
DeviceRegProp = -1073741811;
goto LABEL_30;
}
if( !IoctlOutputBuffer || v5 < 0x14 )
goto LABEL_58;
DeviceRegProp = CmValidateDeviceName(v10);
if( DeviceRegProp < 0 )
{
LABEL_30:
if( DeviceRegProp != -2147483608 )
goto LABEL_23;
v21 = RequiredSize;
goto LABEL_61;
}
if( CmIsRootDevice(SourceString[0]) )
{
DeviceRegProp = -1073741773;
goto LABEL_23;
}
v15 = v5 - 20;
v16 = 0;
if( v15 >= 2 )
v16 = v15;
if( v16 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, v16, 879783504i64);
v9 = PoolWithTag;
if( !PoolWithTag )
{
DeviceRegProp = -1073741670;
goto LABEL_23;
}
*(_WORD *)PoolWithTag = 0;
}
v18 = v13 - 1;
if( !v18 )
{
if( !PiAuDoesClientHaveAccess(0x20ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
{
DeviceRegProp = -1073741790;
goto LABEL_20;
}
if( (v33[1] & 0xFFFFFFFE) == 0 )
{
v7 = v33[1] & 1;
goto LABEL_20;
}
LABEL_58:
DeviceRegProp = -1073741811;
goto LABEL_23;
}
v22 = v18 - 1;
if( !v22 )
{
LODWORD(IoctlOutputBufferSizea) = 0;
HIDWORD(DeviceStatus) = 4;
DeviceRegProp = CmGetDeviceRegProp(
*(&stru_140CF2E80 + 607),
v6,
0i64,
16i64,
(UINT64 *)((char *)&DeviceProblem + 4),
PropertyBuffer,
(UINT64 *)((char *)&DeviceStatus + 4),
IoctlOutputBufferSizea);
if( DeviceRegProp < 0 )
goto LABEL_20;
v7 = 8;
if( (PropertyBuffer[0] & 8) != 0 )
{
if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0x19ui64) )
goto LABEL_49;
}
else
{
DeviceRegProp = PnpGetCallerSessionId(&SessionId);
if( DeviceRegProp < 0 || (_DWORD)SessionId != (unsigned int)RtlGetActiveConsoleId() )
{
DeviceRegProp = PiAuCheckClientInteractive((UINT8 *)ClientInteractive);
if( DeviceRegProp < 0 || !ClientInteractive[0] )
{
if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
goto LABEL_49;
DeviceRegProp = 0;
}
}
}
if( !v33[1] )
goto LABEL_20;
goto LABEL_58;
}
if( v22 != 1 )
{
DeviceRegProp = -1073741811;
goto LABEL_20;
}
if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
{
LABEL_49:
DeviceRegProp = -1073741790;
goto LABEL_23;
}
if( v33[1] )
goto LABEL_58;
v7 = 2;
if( CmGetDeviceStatus(
*(&stru_140CF2E80 + 607),
v6,
0i64,
&DeviceStatus,
&DeviceProblem,
(INT64 *)((char *)&SessionId + 4),
(UINT64)IoctlOutputBuffera) < 0 )
{
DeviceRegProp = -1073741810;
goto LABEL_23;
}
if( (DeviceStatus & 0x2000) == 0 )
{
DeviceRegProp = -1073741808;
goto LABEL_23;
}
LABEL_20:
v8 = v16;
if( DeviceRegProp < 0 )
goto LABEL_30;
DeviceRegProp = RtlInitUnicodeStringEx(DestinationString, v6);
if( DeviceRegProp < 0 )
goto LABEL_30;
LODWORD(RequiredSize) = v16;
DeviceRegProp = PnpQueueQueryAndRemoveEvent(
&DestinationString[0].Length,
(char *)&RequiredSize + 4,
v9,
&RequiredSize,
v7,
0);
if( DeviceRegProp != -2147483608 )
{
LABEL_23:
LODWORD(IoctlOutputBufferSizea) = v38;
LODWORD(ExpectedOutputSize) = v35;
LODWORD(BufferSize) = 0;
v19 = PiCMReturnBufferResultData(
(unsigned int)DeviceRegProp,
(unsigned int)RequiredSize,
HIDWORD(RequiredSize),
0i64,
BufferSize,
ExpectedOutputSize,
IoctlOutputBuffer,
IoctlOutputBufferSizea,
BytesUseda);
goto LABEL_24;
}
v21 = RequiredSize;
v8 = v16;
if( v9 )
*((_WORD *)v9 + ((unsigned __int64)v16 >> 1) - 1) = 0;
LABEL_61:
if( v21 > v8 )
goto LABEL_23;
LODWORD(IoctlOutputBufferSizea) = v38;
LODWORD(ExpectedOutputSize) = v35;
LODWORD(BufferSize) = v21;
v19 = PiCMReturnBufferResultData(
0x80000028ui64,
(unsigned int)RequiredSize,
HIDWORD(RequiredSize),
v9,
BufferSize,
ExpectedOutputSize,
IoctlOutputBuffer,
IoctlOutputBufferSizea,
BytesUseda);
LABEL_24:
v11 = v19;
if( v9 )
ExFreePoolWithTag(v9, 0x34706E50u);
LABEL_26:
if( (byte_140C130BB & 4) != 0 )
McTemplateK0z_EtwWriteTransfer((__int64)v10, (const _EVENT_DESCRIPTOR *)KMPnPEvt_CfgMgr_QueryRemove_Stop, v12, v6);
PiCMReleaseObjectInputData(v33);
return v11;
}Referenced by:
PiCMHandleIoctl