PipRecordOpenHandleVeto
VOID __fastcall PipRecordOpenHandleVeto(UINT64 a1, VOID **a2, DEVICE_OBJECT *a3, INT64 a4, INT64 a5){
WCHAR v6;
__int64 v7;
_DEVICE_OBJECT *DeviceAttachmentBaseRef;
UNICODE_STRING *v9;
struct _DMA_ADAPTER *v10;
*(_DWORD *)a5 = 5;
PnpCollectOpenHandles((DEVICE_OBJECT **)a2, (VOID *)(unsigned int)a1, a4);
v7 = 0i64;
if( a3 )
{
DeviceAttachmentBaseRef = IoGetDeviceAttachmentBaseRef(a3);
v10 = (struct _DMA_ADAPTER *)DeviceAttachmentBaseRef;
if( DeviceAttachmentBaseRef )
v7 = *(_QWORD *)(*((_QWORD *)DeviceAttachmentBaseRef + 39) + 40i64);
RtlCopyUnicodeString((UNICODE_STRING *)(a5 + 8), (UNICODE_STRING *)(v7 + 40), v9);
HalPutDmaAdapter(v10);
}
else
{
RtlInitUnicodeString((PUNICODE_STRING)(a5 + 8), 0i64, v6);
}
}Referenced by:
PipSendQueryRemoveIrpAndCheckOpenHandles