PiCMQueryRemove

NTSTATUS __stdcall PiCMQueryRemove(
        PVOID IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        PVOID IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  unsigned int v5; 
  wchar_t *v6; 
  int v7; 
  unsigned int v8; 
  WCHAR *v9; 
  INT64 v10; 
  NTSTATUS v11; 
  INT64 v12; 
  int v13; 
  int DeviceRegProp; 
  unsigned int v15; 
  unsigned int v16; 
  WCHAR *PoolWithTag; 
  int v18; 
  NTSTATUS v19; 
  unsigned int v21; 
  int v22; 
  UINT64 Flags; 
  UINT64 KernelModeCaller; 
  unsigned int IoctlOutputBuffera; 
  UINT64 IoctlOutputBufferSizea; 
  char ClientInteractive[4]; 
  UINT64 VetoNameLength; 
  int v29; 
  int v30; 
  int v31; 
  ULONG SessionId; 
  int v33; 
  int v34; 
  int v35; 
  INT64 v36[2]; 
  PCWSTR SourceString[2]; 
  UINT64 ExpectedOutputSize; 
  struct _UNICODE_STRING DestinationString; 
  int v41; 
  UINT64 *v42; 
  v41 = IoctlOutputBufferSize;
  v29 = 0;
  v34 = 0;
  ExpectedOutputSize = 0i64;
  v5 = IoctlOutputBufferSize;
  DestinationString = 0i64;
  v33 = 0;
  v6 = 0i64;
  *(_OWORD *)v36 = 0i64;
  *(_DWORD *)v42 = 0;
  v7 = 0;
  *(_OWORD *)SourceString = 0i64;
  v31 = 0;
  v8 = 0;
  v30 = 0;
  v9 = 0i64;
  v35 = 0;
  ClientInteractive[0] = 0;
  SessionId = 0;
  VetoNameLength = 0i64;
  v11 = PiCMCaptureObjectInputData((UINT64)IoctlInputBuffer, IoctlInputBufferSize, (unsigned int)BytesUsed, (INT64)v36);
  if( v11 < 0 )
    goto LABEL_26;
  v6 = (wchar_t *)SourceString[0];
  v13 = HIDWORD(SourceString[1]);
  if( (byte_140C130BB & 4) != 0 )
    McTemplateK0dz_EtwWriteTransfer(
      v10,
      &KMPnPEvt_CfgMgr_QueryRemove_Start,
      v12,
      HIDWORD(SourceString[1]),
      SourceString[0]);
  if( !v6 || LODWORD(v36[1]) != 1 )
  {
    DeviceRegProp = -1073741811;
    goto LABEL_30;
  }
  if( !IoctlOutputBuffer || v5 < 0x14 )
    goto LABEL_58;
  DeviceRegProp = CmValidateDeviceName(v10, v6);
  if( DeviceRegProp < 0 )
  {
LABEL_30:
    if( DeviceRegProp != -2147483608 )
      goto LABEL_23;
    v21 = VetoNameLength;
    goto LABEL_61;
  }
  if( CmIsRootDevice(v6) )
  {
    DeviceRegProp = -1073741773;
    goto LABEL_23;
  }
  v15 = v5 - 20;
  v16 = 0;
  if( v15 >= 2 )
    v16 = v15;
  if( v16 )
  {
    PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v16, 0x34706E50ui64);
    v9 = PoolWithTag;
    if( !PoolWithTag )
    {
      DeviceRegProp = -1073741670;
      goto LABEL_23;
    }
    *PoolWithTag = 0;
  }
  v18 = v13 - 1;
  if( !v18 )
  {
    if( !PiAuDoesClientHaveAccess(0x20ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
    {
      DeviceRegProp = -1073741790;
      goto LABEL_20;
    }
    if( (v36[0] & 0xFFFFFFFE00000000ui64) == 0 )
    {
      v7 = BYTE4(v36[0]) & 1;
      goto LABEL_20;
    }
LABEL_58:
    DeviceRegProp = -1073741811;
    goto LABEL_23;
  }
  v22 = v18 - 1;
  if( !v22 )
  {
    v30 = 4;
    DeviceRegProp = CmGetDeviceRegProp(PiPnpRtlCtx, v6, 0i64, 16, (__int64)&v35, (__int64)&v31, (__int64)&v30, 0);
    if( DeviceRegProp < 0 )
      goto LABEL_20;
    v7 = 8;
    if( (v31 & 8) != 0 )
    {
      if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0x19ui64) )
        goto LABEL_49;
    }
    else
    {
      DeviceRegProp = PnpGetCallerSessionId((UINT64)&SessionId);
      if( DeviceRegProp < 0 || SessionId != (unsigned int)RtlGetActiveConsoleId() )
      {
        DeviceRegProp = PiAuCheckClientInteractive((UINT8)ClientInteractive);
        if( DeviceRegProp < 0 || !ClientInteractive[0] )
        {
          if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
            goto LABEL_49;
          DeviceRegProp = 0;
        }
      }
    }
    if( !HIDWORD(v36[0]) )
      goto LABEL_20;
    goto LABEL_58;
  }
  if( v22 != 1 )
  {
    DeviceRegProp = -1073741811;
    goto LABEL_20;
  }
  if( !PiAuDoesClientHaveAccess(4ui64) || !PiAuDoesClientHavePrivilege(0xAui64) )
  {
LABEL_49:
    DeviceRegProp = -1073741790;
    goto LABEL_23;
  }
  if( HIDWORD(v36[0]) )
    goto LABEL_58;
  v7 = 2;
  if( (int)CmGetDeviceStatus(PiPnpRtlCtx, v6, 0i64, &v29, &v34, &v33, IoctlOutputBuffera) < 0 )
  {
    DeviceRegProp = -1073741810;
    goto LABEL_23;
  }
  if( (v29 & 0x2000) == 0 )
  {
    DeviceRegProp = -1073741808;
    goto LABEL_23;
  }
LABEL_20:
  v8 = v16;
  if( DeviceRegProp < 0 )
    goto LABEL_30;
  DeviceRegProp = RtlInitUnicodeStringEx(&DestinationString, v6);
  if( DeviceRegProp < 0 )
    goto LABEL_30;
  LODWORD(VetoNameLength) = v16;
  LODWORD(KernelModeCaller) = 0;
  LODWORD(Flags) = v7;
  DeviceRegProp = PnpQueueQueryAndRemoveEvent(
                    &DestinationString,
                    (PNP_VETO_TYPE *)&VetoNameLength + 1,
                    v9,
                    &VetoNameLength,
                    Flags,
                    KernelModeCaller);
  if( DeviceRegProp != -2147483608 )
  {
LABEL_23:
    LODWORD(IoctlOutputBufferSizea) = v41;
    LODWORD(KernelModeCaller) = ExpectedOutputSize;
    LODWORD(Flags) = 0;
    v19 = PiCMReturnBufferResultData(
            (unsigned int)DeviceRegProp,
            (unsigned int)VetoNameLength,
            HIDWORD(VetoNameLength),
            0i64,
            Flags,
            KernelModeCaller,
            IoctlOutputBuffer,
            IoctlOutputBufferSizea,
            v42);
    goto LABEL_24;
  }
  v21 = VetoNameLength;
  v8 = v16;
  if( v9 )
    v9[((unsigned __int64)v16 >> 1) - 1] = 0;
LABEL_61:
  if( v21 > v8 )
    goto LABEL_23;
  LODWORD(IoctlOutputBufferSizea) = v41;
  LODWORD(KernelModeCaller) = ExpectedOutputSize;
  LODWORD(Flags) = v21;
  v19 = PiCMReturnBufferResultData(
          2147483688i64,
          (unsigned int)VetoNameLength,
          HIDWORD(VetoNameLength),
          (UINT8 *)v9,
          Flags,
          KernelModeCaller,
          IoctlOutputBuffer,
          IoctlOutputBufferSizea,
          v42);
LABEL_24:
  v11 = v19;
  if( v9 )
    ExFreePoolWithTag(v9, 0x34706E50u);
LABEL_26:
  if( (byte_140C130BB & 4) != 0 )
    McTemplateK0z_EtwWriteTransfer(v10, &KMPnPEvt_CfgMgr_QueryRemove_Stop, v12, v6);
  PiCMReleaseObjectInputData((INT64)v36);
  return v11;
}

Referenced by: