PnpCancelRemoveOnHungDevices
INT64 __fastcall PnpCancelRemoveOnHungDevices(INT64 a1, INT64 rdx0, CHAR a3, UINT64 **r9_0, CHAR **a5){
unsigned int v6;
int v8;
CHAR *RelationList;
__int64 v10;
INT64 v11;
__int64 v12;
DRIVER_OBJECT **v13;
__int64 v14;
int v15;
int v16;
void *v17;
int a2[2];
PVOID Object;
void *P[2];
unsigned int a4;
Object = 0i64;
v6 = rdx0;
a4 = 0;
P[0] = 0i64;
if( (rdx0 & 0xFFFFFFFB) != 0 )
__fastfail(5u);
v8 = PnpCompileDeviceInstancePaths((unsigned int)rdx0, r9_0, a3, 1, a5);
if( v8 >= 0 )
{
RelationList = IopAllocateRelationList(v6);
if( RelationList )
{
*(_QWORD *)a2 = 2i64;
while( IopEnumerateRelations((unsigned int **)r9_0, a2, &Object, &a4, 0i64) )
{
if( Object )
v10 = *(_QWORD *)(*((_QWORD *)Object + 39) + 40i64);
else
v10 = 0i64;
if( v10 )
{
if( (*(_DWORD *)(v10 + 704) & 2) != 0 )
{
v8 = IopAddRelationToList((INT64)RelationList, (INT64)Object, a4, 0i64);
if( v8 < 0 )
goto LABEL_35;
}
}
}
RelationList[8] = 1;
*(_QWORD *)a2 = 1i64;
while( IopEnumerateRelations((unsigned int **)RelationList, a2, &Object, 0i64, 0i64) )
{
if( Object )
v12 = *(_QWORD *)(*((_QWORD *)Object + 39) + 40i64);
else
v12 = 0i64;
if( *(_DWORD *)(v12 + 300) == 784 )
PnpDeleteLockedDeviceNode((_DEVICE_NODE *)v12, CancelRemoveDevice, 0i64, v11, 0i64, 0i64);
}
*(_QWORD *)a2 = 1i64;
while( IopEnumerateRelations((unsigned int **)RelationList, a2, &Object, 0i64, 0i64) )
{
if( Object )
v14 = *(_QWORD *)(*((_QWORD *)Object + 39) + 40i64);
else
v14 = 0i64;
v15 = *(_DWORD *)(v14 + 300);
if( v15 != 786 && v15 != 770 && v15 != 769 )
PnpNotifyTargetDeviceChange((GUID *)GUID_TARGET_DEVICE_REMOVE_CANCELLED, (DEVICE_OBJECT *)Object, 0i64, v13);
}
v16 = PnpCompileDeviceInstancePaths(v6, (UINT64 **)RelationList, 0, (CHAR)v13, (CHAR **)P);
v17 = P[0];
v8 = v16;
if( v16 >= 0 )
v8 = PnpNotifyUserModeDeviceRemoval(
a1,
(_WORD *)P[0],
(__int128 *)GUID_TARGET_DEVICE_REMOVE_CANCELLED,
0i64,
0i64,
0i64);
if( v17 )
ExFreePoolWithTag(v17, 0x4B706E50u);
LABEL_35:
IopFreeRelationList(RelationList);
}
else
{
return(unsigned int)-1073741801;
}
}
return(unsigned int)v8;
}Referenced by:
PiProcessQueryAndCancelRemoval