PnpRecordBlackboxPnpEventInformation
VOID **__fastcall PnpRecordBlackboxPnpEventInformation(INT64 a1, int a2, __int64 a3, char a4){
int v5;
const VOID **v6;
VOID *v7;
__int64 v8;
__int64 v9;
char v10;
__int64 v11;
unsigned int v12;
VOID **result;
VOID **v14;
__int128 v15;
int v16;
int v17;
UINT64 OutputBufferLength;
__int64 InputBuffer[3];
int v20;
int v21;
v5 = 0;
v6 = 0i64;
v7 = *(VOID **)&KUSER_SHARED_DATA.SystemTime.LowPart;
LODWORD(v8) = PiGetTargetDeviceNode(a1);
v11 = v8;
v12 = *(unsigned __int16 *)(v8 + 40) + 50;
if( a3 )
{
v6 = (const VOID **)(a3 + 8);
if( !v10 && a3 != -8 )
{
v17 = *(unsigned __int16 *)v6;
if( (_WORD)v17 )
{
if( *(_QWORD *)(a3 + 16) != v9 )
v5 = v17 + 2;
}
}
}
result = ExAllocatePoolWithTag(0x200ui64, v5 + v12, 1265659472i64);
v14 = result;
if( result )
{
InputBuffer[2] = 0i64;
v21 = 0;
memset(result, 0i64, v5 + v12);
v15 = *(_OWORD *)(a1 + 88);
v14[2] = v7;
*(_OWORD *)v14 = v15;
v16 = *(_DWORD *)(a1 + 16);
*((_DWORD *)v14 + 6) = a2;
*((_DWORD *)v14 + 8) = v16;
*((_BYTE *)v14 + 28) = a4;
memmove((char *)v14 + 44, *(const VOID **)(v11 + 48), *(unsigned __int16 *)(v11 + 40));
*((_WORD *)v14 + ((unsigned __int64)*(unsigned __int16 *)(v11 + 40) >> 1) + 22) = 0;
if( v5 )
{
*((_DWORD *)v14 + 9) = *(_DWORD *)a3;
*((_DWORD *)v14 + 10) = v12;
memmove((char *)v14 + v12, v6[1], *(unsigned __int16 *)v6);
*(_WORD *)((char *)v14 + 2 * ((unsigned __int64)*(unsigned __int16 *)v6 >> 1) + v12) = 0;
}
v20 = 2;
InputBuffer[0] = (__int64)v14;
InputBuffer[1] = v5 + v12;
LODWORD(OutputBufferLength) = 0;
NtPowerInformation(
PowerInformationLevelMaximum|SystemPowerCapabilities,
InputBuffer,
0x20ui64,
0i64,
OutputBufferLength);
return(VOID **)ExFreePoolWithTag(v14, 0x4B706E50u);
}
return result;
}Referenced by:
PnpProcessQueryRemoveAndEject