PnpLogVetoInformation

VOID __stdcall PnpLogVetoInformation(_UNICODE_STRING *DeviceInstance, _LIST_ENTRY *VetoProcessListHead){
  _LIST_ENTRY *Flink; 
  bool i; 
  _LIST_ENTRY **p_Blink; 
  char v7; 
  _EPROCESS *v8; 
  UINT64 v9; 
  _UNICODE_STRING *v10; 
  const char *ProcessImageFileName; 
  INT8 v12; 
  char *j; 
  __int64 v14; 
  char *v15; 
  struct _STRING DestinationString; 
  UNICODE_STRING v17; 
  PVOID P; 
  _EPROCESS *Process; 
  Flink = VetoProcessListHead->Flink;
  P = 0i64;
  v17 = 0i64;
  Process = 0i64;
  for( i = VetoProcessListHead == Flink; ; i = VetoProcessListHead == Flink )
  {
    p_Blink = &Flink[-2].Blink;
    if( i )
      break;
    v7 = 0;
    if( PsLookupProcessByProcessId((HANDLE)*((unsigned int *)p_Blink + 4), (PEPROCESS *)&Process) >= 0 )
    {
      v8 = Process;
      if( (int)PsGetAllocatedFullProcessImageName((__int64)Process, &P) >= 0 )
      {
        v10 = (_UNICODE_STRING *)P;
        if( !*(_WORD *)P )
        {
          v7 = 1;
          DestinationString = 0i64;
          ExFreePoolWithTag(P, 0);
          v10 = &v17;
          P = &v17;
          ProcessImageFileName = (const char *)PsGetProcessImageFileName((__int64)v8);
          RtlInitAnsiString(&DestinationString, ProcessImageFileName, v12);
          RtlAnsiStringToUnicodeString(&v17, &DestinationString, 1u);
        }
      }
      else
      {
        v10 = 0i64;
        P = 0i64;
      }
      PnpDiagnosticTraceAppVeto(v9, (UNICODE_STRING *)*((unsigned int *)v8 + 272), v10);
      for( j = (char *)*p_Blink; ; j = (char *)*((_QWORD *)v15 + 1) )
      {
        v15 = j - 8;
        if( p_Blink == (_LIST_ENTRY **)j )
          break;
        if( *(_QWORD *)v15 )
          v14 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)v15 + 312i64) + 40i64);
        else
          v14 = 0i64;
        PnpTraceDeviceRemoveProcessVeto(DeviceInstance, (UNICODE_STRING *)(v14 + 40), v10);
      }
      if( v7 )
      {
        RtlFreeAnsiString(v10);
      }
      else if( v10 )
      {
        ExFreePoolWithTag(v10, 0);
      }
      ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
    }
    Flink = p_Blink[3];
  }
}

Referenced by: