PnpDiagnosticTraceAppVeto
NTSTATUS __stdcall PnpDiagnosticTraceAppVeto(
UINT64 ProcessId,
UNICODE_STRING *ProcessName,
UNICODE_STRING *DeviceInstance){
__int64 v3;
unsigned __int16 v4;
wchar_t *Buffer;
__int64 v6;
unsigned __int16 v8;
unsigned __int16 v9;
struct _EVENT_DATA_DESCRIPTOR UserData;
__int16 *v11;
__int64 v12;
wchar_t *v13;
int v14;
int v15;
unsigned __int16 *v16;
__int64 v17;
__int64 v18;
int v19;
int v20;
int v21;
v21 = (int)ProcessName;
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&v21;
if( DeviceInstance )
v4 = DeviceInstance->Length >> 1;
else
v4 = 0;
v8 = v4;
v11 = (__int16 *)&v8;
v12 = 2i64;
if( DeviceInstance )
Buffer = DeviceInstance->Buffer;
else
Buffer = 0i64;
v13 = Buffer;
v14 = 2 * v4;
v9 = *(_WORD *)v3 >> 1;
v16 = &v9;
v6 = *(_QWORD *)(v3 + 8);
v19 = 2 * v9;
v15 = 0;
v20 = 0;
v17 = 2i64;
v18 = v6;
return PnpDiagnosticTrace(&KMPnPEvt_DeviceEject_Pend, 5ui64, &UserData);
}Referenced by:
PnpLogVetoInformation