PnpDisableDeviceInterfaces

__int64 __fastcall PnpDisableDeviceInterfaces(unsigned __int16 *a1, __int64 a2, INT64 a3){
  _ETHREAD *CurrentThread; 
  VOID **PoolWithTag; 
  int MatchingFilteredDeviceInterfaceList; 
  unsigned int v7; 
  WCHAR *i; 
  INT64 v10; 
  VOID *MatchCallbackContext; 
  _UNICODE_STRING DestinationString; 
  _BYTE savedregs[40]; 
  _CM_OBJECT_TYPE v14; 
  WCHAR *DeviceInstanceId; 

  v14 = CM_OBJECT_TYPE_NONE;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PoolWithTag = 0i64;
  DeviceInstanceId = 0i64;
  DestinationString = 0i64;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 6688, 1, a3);
  MatchingFilteredDeviceInterfaceList = PnpUnicodeStringToWstr((__int16 **)&DeviceInstanceId, 0i64, a1);
  if( MatchingFilteredDeviceInterfaceList >= 0 )
  {
    v14 = 4096;
    MatchingFilteredDeviceInterfaceList = -1073741789;
    v7 = 0;
    while( v7 < 5 )
    {
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0);
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 2i64 * (unsigned int)v14, 538996816i64);
      if( !PoolWithTag )
      {
        MatchingFilteredDeviceInterfaceList = -1073741670;
        break;
      }
      LODWORD(MatchCallbackContext) = 0;
      ++v7;
      MatchingFilteredDeviceInterfaceList = CmGetMatchingFilteredDeviceInterfaceList(
                                              *(&stru_140CF2E80 + 607),
                                              0i64,
                                              DeviceInstanceId,
                                              1i64,
                                              0i64,
                                              0i64,
                                              (const WCHAR *)PoolWithTag,
                                              v14,
                                              &v14,
                                              MatchCallbackContext,
                                              *(WCHAR **)&DestinationString.Length,
                                              (UINT64)DestinationString.Buffer,
                                              *(UINT64 **)savedregs,
                                              *(UINT64 *)&savedregs[8]);
      if( MatchingFilteredDeviceInterfaceList != -1073741789 )
        break;
    }
    if( MatchingFilteredDeviceInterfaceList >= 0 )
    {
      for( i = (WCHAR *)PoolWithTag; *i; i += ((unsigned __int64)DestinationString.Length + 2) >> 1 )
      {
        MatchingFilteredDeviceInterfaceList = RtlInitUnicodeStringEx(&DestinationString, i);
        if( MatchingFilteredDeviceInterfaceList >= 0 )
          IoSetDeviceInterfaceState((INT64)&DestinationString, 0, v10);
      }
    }
  }
  ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 6688));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  PnpUnicodeStringToWstrFree(DeviceInstanceId, (__int64)a1);
  return(unsigned int)MatchingFilteredDeviceInterfaceList;
}

Referenced by:

PnpSurpriseRemoveLockedDeviceNode