PipRecordOpenHandleVeto

VOID __fastcall PipRecordOpenHandleVeto(UINT64 a1, VOID **a2, DEVICE_OBJECT *a3, INT64 a4, INT64 a5){
  WCHAR v6; 
  __int64 v7; 
  _DEVICE_OBJECT *DeviceAttachmentBaseRef; 
  UNICODE_STRING *v9; 
  struct _DMA_ADAPTER *v10; 
  *(_DWORD *)a5 = 5;
  PnpCollectOpenHandles((DEVICE_OBJECT **)a2, (VOID *)(unsigned int)a1, a4);
  v7 = 0i64;
  if( a3 )
  {
    DeviceAttachmentBaseRef = IoGetDeviceAttachmentBaseRef(a3);
    v10 = (struct _DMA_ADAPTER *)DeviceAttachmentBaseRef;
    if( DeviceAttachmentBaseRef )
      v7 = *(_QWORD *)(*((_QWORD *)DeviceAttachmentBaseRef + 39) + 40i64);
    RtlCopyUnicodeString((UNICODE_STRING *)(a5 + 8), (UNICODE_STRING *)(v7 + 40), v9);
    HalPutDmaAdapter(v10);
  }
  else
  {
    RtlInitUnicodeString((PUNICODE_STRING)(a5 + 8), 0i64, v6);
  }
}

Referenced by:

PipSendQueryRemoveIrpAndCheckOpenHandles