PiDqIrpQueryCreate
NTSTATUS __stdcall PiDqIrpQueryCreate(_IRP *Irp){
_IRP *v1;
_IO_STACK_LOCATION *CurrentStackLocation;
__int64 v3;
char v4;
const _GUID *v5;
_ETHREAD *CurrentThread;
int v7;
int v8;
NTSTATUS ValidateQueryData;
__int64 *v10;
__int64 v11;
UINT64 SecurityContext_low;
_ETHREAD *v13;
PVOID v15;
VOID **v16;
__int64 v17;
int v18;
int v19;
const wchar_t *v20;
VOID **v21;
NTSTATUS v22;
VOID **v23;
unsigned int v24;
VOID **v25;
unsigned int v26;
_WORD *v27;
VOID **v28;
NTSTATUS v29;
VOID **v30;
VOID **v31;
NTSTATUS v32;
unsigned int CurrentThreadProcessId;
__int64 v34;
unsigned int v35;
VOID **PoolWithTag;
unsigned int v37;
PVOID v38;
_WORD *v39;
UINT64 *MinBytesNeeded;
char v41;
VOID **P;
UINT64 RequiredSize;
UINT64 NumberOfBytes;
PVOID v45;
UINT64 BytesUsed;
_IRP *v47;
PVOID v48;
PVOID v49;
UINT64 v50;
PVOID v51;
PVOID FsContext2;
const _GUID *v53;
_IRP *Irpa;
_IO_STACK_LOCATION *v55;
WCHAR *ObjectTypeString;
ULONG_PTR PushLock[2];
_DEV_QUERY_IOCTL_CONTROL_BLOCK ControlBlock;
_GUID ActivityId;
v1 = Irp;
Irpa = Irp;
v47 = Irp;
CurrentStackLocation = Irp->Tail.CurrentStackLocation;
v55 = CurrentStackLocation;
v49 = CurrentStackLocation;
FsContext2 = CurrentStackLocation->FileObject->FsContext2;
v3 = (__int64)FsContext2;
v4 = 0;
v5 = 0i64;
v53 = 0i64;
ActivityId = 0i64;
v41 = 0;
LODWORD(BytesUsed) = 0;
LODWORD(v50) = 0;
ControlBlock = 0i64;
if( !FsContext2 )
{
ValidateQueryData = -1073741637;
goto LABEL_18;
}
if( !Irp->AssociatedIrp.MasterIrp )
{
ValidateQueryData = -1073741811;
goto LABEL_18;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
*(_QWORD *)PushLock = v3 + 64;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v3 + 64), 0i64);
v7 = *(_DWORD *)(v3 + 216);
if( (v7 & 8) != 0 )
{
ValidateQueryData = -1073741536;
}
else if( (v7 & 0x10) != 0 || (v8 = v7 | 0x10, *(_DWORD *)(v3 + 216) = v8, v4 = 1, (v8 & 4) != 0) )
{
ValidateQueryData = -1073741637;
}
else
{
if( LODWORD(CurrentStackLocation->Parameters.SecurityContext) >= 0x10 )
{
ValidateQueryData = MesDecodeBufferHandleCreate(
v1->AssociatedIrp.MasterIrp,
CurrentStackLocation->Parameters.Options,
v3 + 16);
if( ValidateQueryData < 0 )
goto LABEL_15;
v10 = (__int64 *)(v3 + 24);
NdrMesTypeDecode3(*(_QWORD *)(v3 + 16), "TP 3\a", &off_140001290, (char *)&stru_140C00F40 + 2832, 0, v3 + 24);
ValidateQueryData = PiDqQueryValidateQueryData(*v10);
if( ValidateQueryData < 0 )
goto LABEL_14;
if( !PnpIsNullGuid((VOID *)*v10) )
{
ActivityId = *(_GUID *)*v10;
LODWORD(v11) = IoSetActivityIdThread((INT64)&ActivityId);
v5 = (const _GUID *)v11;
v53 = (const _GUID *)v11;
v41 = 1;
}
if( (byte_140C130BA & 0x40) == 0 )
{
LABEL_13:
*(_DWORD *)(v3 + 216) |= 4u;
LABEL_14:
v4 = 1;
goto LABEL_15;
}
v15 = 0i64;
v45 = 0i64;
FsContext2 = 0i64;
ObjectTypeString = 0i64;
v49 = 0i64;
v16 = 0i64;
v51 = 0i64;
v48 = 0i64;
v17 = *v10;
if( PiDqConvertObjectTypeToString(*(_DEV_OBJECT_TYPE *)(v17 + 16), &ObjectTypeString) < 0 )
{
LABEL_87:
if( v48 )
ExFreePoolWithTag(v48, 0x58706E50u);
if( v16 )
ExFreePoolWithTag(v16, 0x58706E50u);
if( v49 )
ExFreePoolWithTag(v49, 0x58706E50u);
if( v51 )
ExFreePoolWithTag(v51, 0x58706E50u);
if( v15 )
ExFreePoolWithTag(v15, 0x58706E50u);
v5 = v53;
goto LABEL_13;
}
v18 = 0;
v47 = 0i64;
v19 = *(_DWORD *)(v17 + 20);
if( v19 )
{
if( v19 == 1 )
{
v20 = L"Instance";
}
else
{
if( v19 != 2 )
{
v18 = -1073741811;
goto LABEL_41;
}
v20 = L"Instances";
}
}
else
{
v20 = L"Type";
}
v47 = (_IRP *)v20;
LABEL_41:
if( v18 < 0 )
goto LABEL_87;
if( v19 == 1 )
{
FsContext2 = *(PVOID *)(v17 + 24);
}
else if( v19 == 2 )
{
v35 = *(_DWORD *)(v17 + 24);
if( v35 <= 2 )
goto LABEL_87;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 2i64 * v35, 1483763280i64);
v48 = PoolWithTag;
if( !PoolWithTag )
goto LABEL_87;
memmove(PoolWithTag, *(const VOID **)(v17 + 32), 2 * *(_DWORD *)(v17 + 24));
v37 = *(_DWORD *)(v17 + 24) - 2;
v38 = v48;
if( *(_DWORD *)(v17 + 24) != 2 )
{
v39 = (char *)v48 + 2 * v37;
do
{
if( !*v39 )
*v39 = 32;
--v39;
--v37;
}
while( v37 );
}
FsContext2 = v38;
}
LODWORD(RequiredSize) = 512;
v21 = ExAllocatePoolWithTag(1ui64, 0x200ui64, 1483763280i64);
P = v21;
if( !v21 )
{
v16 = 0i64;
goto LABEL_87;
}
v22 = PiDqConvertQueryFlagsToString(*(unsigned int *)(v17 + 40), (WCHAR *)v21, 0x200ui64, &RequiredSize);
if( v22 == -1073741789 )
{
ExFreePoolWithTag(P, 0x58706E50u);
v23 = ExAllocatePoolWithTag(1ui64, (unsigned int)RequiredSize, 1483763280i64);
P = v23;
if( !v23 )
{
v16 = 0i64;
v15 = 0i64;
goto LABEL_87;
}
v22 = PiDqConvertQueryFlagsToString(
*(unsigned int *)(v17 + 40),
(WCHAR *)v23,
(unsigned int)RequiredSize,
&RequiredSize);
}
if( v22 < 0 )
goto LABEL_85;
if( (*(_DWORD *)(v17 + 40) & 4) != 0 )
{
v24 = *(_DWORD *)(v17 + 48);
if( v24 <= 2 )
goto LABEL_85;
v25 = ExAllocatePoolWithTag(1ui64, 2i64 * v24, 1483763280i64);
v49 = v25;
if( !v25 )
goto LABEL_85;
memmove(v25, *(const VOID **)(v17 + 56), 2 * *(_DWORD *)(v17 + 48));
v26 = *(_DWORD *)(v17 + 48) - 2;
if( *(_DWORD *)(v17 + 48) != 2 )
{
v27 = (char *)v49 + 2 * v26;
do
{
if( !*v27 )
*v27 = 32;
--v27;
--v26;
}
while( v26 );
}
}
if( !*(_DWORD *)(v17 + 64) )
goto LABEL_63;
HIDWORD(RequiredSize) = 512;
v28 = ExAllocatePoolWithTag(1ui64, 0x200ui64, 1483763280i64);
v51 = v28;
if( v28 )
{
v29 = PnpConvertDevpropcompkeyArrayToString(
*(_QWORD *)(v17 + 72),
*(_DWORD *)(v17 + 64),
(WCHAR *)v28,
0x200u,
(unsigned int *)&RequiredSize + 1);
if( v29 == -1073741789 )
{
ExFreePoolWithTag(v51, 0x58706E50u);
v30 = ExAllocatePoolWithTag(1ui64, HIDWORD(RequiredSize), 1483763280i64);
v51 = v30;
if( !v30 )
goto LABEL_85;
v29 = PnpConvertDevpropcompkeyArrayToString(
*(_QWORD *)(v17 + 72),
*(_DWORD *)(v17 + 64),
(WCHAR *)v30,
HIDWORD(RequiredSize),
(unsigned int *)&RequiredSize + 1);
}
if( v29 >= 0 )
{
LABEL_63:
if( !*(_DWORD *)(v17 + 80) )
goto LABEL_69;
LODWORD(NumberOfBytes) = 512;
v31 = ExAllocatePoolWithTag(1ui64, 0x200ui64, 1483763280i64);
v45 = v31;
if( v31 )
{
v32 = FilterConvertToString(
*(unsigned int *)(v17 + 80),
*(_DEVPROP_FILTER_EXPRESSION **)(v17 + 88),
0x200ui64,
(WCHAR *)v31,
&NumberOfBytes);
if( v32 != -1073741789 )
goto LABEL_68;
ExFreePoolWithTag(v45, 0x58706E50u);
v31 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1483763280i64);
v45 = v31;
if( v31 )
{
v32 = FilterConvertToString(
*(unsigned int *)(v17 + 80),
*(_DEVPROP_FILTER_EXPRESSION **)(v17 + 88),
(unsigned int)NumberOfBytes,
(WCHAR *)v31,
&NumberOfBytes);
LABEL_68:
if( v32 < 0 )
{
LABEL_84:
v15 = v45;
goto LABEL_86;
}
LABEL_69:
if( (byte_140C130BA & 0x40) != 0 )
{
CurrentThreadProcessId = (unsigned int)PsGetCurrentThreadProcessId();
v15 = v45;
v16 = P;
LODWORD(MinBytesNeeded) = CurrentThreadProcessId;
McTemplateK0pqzzzzzzz_EtwWriteTransfer((__int64)ObjectTypeString, v34, (const _GUID *)v17, v3);
goto LABEL_87;
}
goto LABEL_84;
}
}
v15 = v31;
LABEL_86:
v16 = P;
goto LABEL_87;
}
}
LABEL_85:
v15 = 0i64;
goto LABEL_86;
}
ValidateQueryData = -1073741789;
}
LABEL_15:
ExReleasePushLockEx(PushLock[0], 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
CurrentStackLocation = v55;
v1 = Irpa;
if( ValidateQueryData >= 0 )
{
SecurityContext_low = LODWORD(v55->Parameters.SecurityContext);
if( (unsigned int)SecurityContext_low <= 0x10 )
LODWORD(BytesUsed) = 16;
else
ValidateQueryData = PiDqQuerySerializeActionQueue(
(PI_DQ_QUERY *)v3,
Irpa->AssociatedIrp.MasterIrp,
SecurityContext_low,
&BytesUsed,
&v50);
}
LABEL_18:
if( v4 )
{
v13 = (_ETHREAD *)KeGetCurrentThread();
--v13->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v3 + 64), 0i64);
if( ValidateQueryData < 0 )
{
*(_DWORD *)(v3 + 216) |= 1u;
PiDqQueryFreeActiveData((_PI_DQ_QUERY *)v3);
}
else
{
PiDqQueryGetNextIoctlInfo(
(_PI_DQ_QUERY *)v3,
LODWORD(CurrentStackLocation->Parameters.SecurityContext),
(unsigned int)v50,
&ControlBlock);
}
*(_DWORD *)(v3 + 216) &= ~0x10u;
ExReleasePushLockEx(v3 + 64, 0);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
PiDqIrpComplete(
v1,
(unsigned int)ValidateQueryData,
(unsigned int)BytesUsed,
&ControlBlock,
(_DEV_QUERY_IOCTL_CONTROL_BLOCK *)MinBytesNeeded);
if( v41 )
IoClearActivityIdThread(v5);
return ValidateQueryData;
}Referenced by:
PiDqDispatch