NtPlugPlayControl

NTSTATUS __stdcall NtPlugPlayControl(
        PLUGPLAY_CONTROL_CLASS PnPControlClass,
        VOID *PnPControlData,
        UINT64 PnPControlDataLength){
  unsigned int v3; 
  __int64 v4; 
  char CallerMode; 
  __int64 *v6; 
  NTSTATUS result; 
  __int64 v8; 
  NTSTATUS v9; 
  NTSTATUS UserModeCallersCopy; 
  UINT64 AllocateDestination; 
  UINT64 AllocateDestinationa; 
  VOID *Src; 
  VOID *Destination; 

  Src = PnPControlData;
  v3 = PnPControlDataLength;
  v4 = (unsigned int)PnPControlClass;
  CallerMode = KeGetCurrentThread()->PreviousMode;
  if( CallerMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, 1) )
    return -1073741727;
  if( (unsigned int)v4 >= 0x18 )
    return -1073741585;
  v6 = &PlugPlayHandlerTable[3 * v4];
  if( *(_DWORD *)v6 != (_DWORD)v4 )
    return -1073741595;
  if( !v6 )
    return -1073741585;
  if( !v6[1] )
    return -1073741822;
  if( *((_DWORD *)v6 + 1) != v3 )
    return -1073741776;
  if( PsIsCurrentThreadInServerSilo() && !*((_BYTE *)v6 + 16) )
    return -1073741727;
  Destination = 0i64;
  LODWORD(AllocateDestination) = 1;
  result = PiControlMakeUserModeCallersCopy(&Destination, Src, v3, 4ui64, CallerMode, AllocateDestination);
  if( result >= 0 )
  {
    LOBYTE(v8) = CallerMode;
    v9 = ((__int64(__fastcall *)(_QWORD, VOID *, _QWORD, __int64))v6[1])((unsigned int)v4, Destination, v3, v8);
    if( (v9 & 0xC0000000) != -1073741824 || v9 == -1073741789 )
    {
      LODWORD(AllocateDestinationa) = 0;
      UserModeCallersCopy = PiControlMakeUserModeCallersCopy(
                              &Src,
                              Destination,
                              v3,
                              4ui64,
                              CallerMode,
                              AllocateDestinationa);
      if( UserModeCallersCopy < 0 )
        v9 = UserModeCallersCopy;
    }
    if( v9 == -1073741738 )
      v9 = -1073741810;
    PiControlFreeUserModeCallersBuffer(CallerMode, Destination);
    return v9;
  }
  return result;
}

Referenced by: