PnpRecordBlackboxPnpEventInformation

VOID **__fastcall PnpRecordBlackboxPnpEventInformation(INT64 a1, int a2, __int64 a3, char a4){
  int v5; 
  const VOID **v6; 
  VOID *v7; 
  __int64 v8; 
  __int64 v9; 
  char v10; 
  __int64 v11; 
  unsigned int v12; 
  VOID **result; 
  VOID **v14; 
  __int128 v15; 
  int v16; 
  int v17; 
  UINT64 OutputBufferLength; 
  __int64 InputBuffer[3]; 
  int v20; 
  int v21; 

  v5 = 0;
  v6 = 0i64;
  v7 = *(VOID **)&KUSER_SHARED_DATA.SystemTime.LowPart;
  LODWORD(v8) = PiGetTargetDeviceNode(a1);
  v11 = v8;
  v12 = *(unsigned __int16 *)(v8 + 40) + 50;
  if( a3 )
  {
    v6 = (const VOID **)(a3 + 8);
    if( !v10 && a3 != -8 )
    {
      v17 = *(unsigned __int16 *)v6;
      if( (_WORD)v17 )
      {
        if( *(_QWORD *)(a3 + 16) != v9 )
          v5 = v17 + 2;
      }
    }
  }
  result = ExAllocatePoolWithTag(0x200ui64, v5 + v12, 1265659472i64);
  v14 = result;
  if( result )
  {
    InputBuffer[2] = 0i64;
    v21 = 0;
    memset(result, 0i64, v5 + v12);
    v15 = *(_OWORD *)(a1 + 88);
    v14[2] = v7;
    *(_OWORD *)v14 = v15;
    v16 = *(_DWORD *)(a1 + 16);
    *((_DWORD *)v14 + 6) = a2;
    *((_DWORD *)v14 + 8) = v16;
    *((_BYTE *)v14 + 28) = a4;
    memmove((char *)v14 + 44, *(const VOID **)(v11 + 48), *(unsigned __int16 *)(v11 + 40));
    *((_WORD *)v14 + ((unsigned __int64)*(unsigned __int16 *)(v11 + 40) >> 1) + 22) = 0;
    if( v5 )
    {
      *((_DWORD *)v14 + 9) = *(_DWORD *)a3;
      *((_DWORD *)v14 + 10) = v12;
      memmove((char *)v14 + v12, v6[1], *(unsigned __int16 *)v6);
      *(_WORD *)((char *)v14 + 2 * ((unsigned __int64)*(unsigned __int16 *)v6 >> 1) + v12) = 0;
    }
    v20 = 2;
    InputBuffer[0] = (__int64)v14;
    InputBuffer[1] = v5 + v12;
    LODWORD(OutputBufferLength) = 0;
    NtPowerInformation(
      PowerInformationLevelMaximum|SystemPowerCapabilities,
      InputBuffer,
      0x20ui64,
      0i64,
      OutputBufferLength);
    return(VOID **)ExFreePoolWithTag(v14, 0x4B706E50u);
  }
  return result;
}

Referenced by:

PnpProcessQueryRemoveAndEject