PiQueryRemovableDeviceOverride

__int64 __fastcall PiQueryRemovableDeviceOverride(__int64 a1, __int64 a2, void *a3, __int64 a4){
  int v4; 
  void *v5; 
  _BYTE *v6; 
  WCHAR *v8; 
  int DeviceRegProp; 
  char v11; 
  NTSTATUS DeviceOverrideEntry; 
  char v13; 
  __int64 v14; 
  int *v15; 
  int v16; 
  unsigned int v17; 
  unsigned int i; 
  VOID *PoolWithTag; 
  void *v20; 
  __int64 v21; 
  char v22; 
  NTSTATUS v24; 
  NTSTATUS v25; 
  VOID *v26; 
  PVOID *v27; 
  SIZE_T NumberOfBytes; 
  void *KeyHandle; 
  struct _UNICODE_STRING ValueName; 
  int v31; 
  __int128 v32; 
  HANDLE RootHandle[2]; 
  HANDLE Handle; 
  int v35; 
  ULONG ResultLength; 
  PVOID P; 
  int v38[2]; 
  _BYTE *v39; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v42; 
  int v43; 
  int v44; 
  Handle = 0i64;
  v4 = 0;
  ResultLength = 0;
  v5 = 0i64;
  P = 0i64;
  v35 = 0;
  v6 = (_BYTE *)a4;
  NumberOfBytes = 0i64;
  v8 = (WCHAR *)a2;
  v39 = (_BYTE *)a4;
  DeviceRegProp = -1073741772;
  v31 = 0;
  ValueName = 0i64;
  if( PnpDeviceOverrideHashList )
  {
    v11 = *(_BYTE *)(a1 + 680);
    DeviceOverrideEntry = -1073741772;
    LOBYTE(a2) = v11;
    v32 = 0i64;
    *(_OWORD *)RootHandle = 0i64;
    if( (v11 & 1) == 0 )
    {
      LODWORD(v32) = 2490404;
      v13 = v11;
      *((_QWORD *)&v32 + 1) = L"ChildLocationPaths";
      if( v8 )
      {
        DeviceOverrideEntry = PipFindDeviceOverrideEntry(v8, (PVOID)a2);
        LOBYTE(a2) = *(_BYTE *)(a1 + 680);
        v13 = a2;
      }
      v11 = v13;
      if( DeviceOverrideEntry >= 0 )
        goto LABEL_40;
      if( a3 )
      {
        DeviceOverrideEntry = PipFindDeviceOverrideEntry((PWCHAR)a3, (PVOID)a2);
        v11 = *(_BYTE *)(a1 + 680);
        LOBYTE(a2) = v11;
      }
      if( DeviceOverrideEntry >= 0 )
      {
LABEL_40:
        ZwClose(RootHandle[0]);
        *(_BYTE *)(a1 + 680) |= 4u;
        v11 = *(_BYTE *)(a1 + 680);
        LOBYTE(a2) = v11;
      }
    }
    if( (v11 & 3) != 1 )
    {
      LODWORD(v32) = 1835034;
      *((_QWORD *)&v32 + 1) = L"LocationPaths";
      if( v8 )
      {
        v24 = PipFindDeviceOverrideEntry(v8, (PVOID)a2);
        v11 = *(_BYTE *)(a1 + 680);
        DeviceRegProp = v24;
        LOBYTE(a2) = v11;
      }
      if( DeviceRegProp >= 0 )
        goto LABEL_41;
      if( a3 )
      {
        v25 = PipFindDeviceOverrideEntry((PWCHAR)a3, (PVOID)a2);
        v11 = *(_BYTE *)(a1 + 680);
        DeviceRegProp = v25;
        LOBYTE(a2) = v11;
      }
      if( DeviceRegProp >= 0 )
LABEL_41:
        v11 = a2 | 2;
    }
    *(_BYTE *)(a1 + 680) = v11 | 1;
    if( DeviceRegProp < 0 )
    {
      v14 = *(_QWORD *)(a1 + 16);
      if( (*(_BYTE *)(v14 + 680) & 5) != 1 )
      {
        LODWORD(v32) = 2490404;
        *((_QWORD *)&v32 + 1) = L"ChildLocationPaths";
        DeviceRegProp = PnpDeviceObjectToDeviceInstance(*(DEVICE_OBJECT **)(v14 + 32), &Handle, 0x20019ui64);
        if( DeviceRegProp < 0 )
          return(unsigned int)DeviceRegProp;
        v38[0] = 2;
        v15 = v38;
        v16 = 256;
        v38[1] = 3;
        LODWORD(NumberOfBytes) = 256;
        v17 = 256;
        for( i = 0; i < 2; ++i )
        {
          DeviceRegProp = 0;
          if( !v5 )
          {
            PoolWithTag = ExAllocatePoolWithTag(PagedPool, v17, 0x6E697050ui64);
            v16 = NumberOfBytes;
            v5 = PoolWithTag;
            if( !PoolWithTag )
              DeviceRegProp = -1073741670;
          }
          if( DeviceRegProp >= 0 )
          {
            DeviceRegProp = CmGetDeviceRegProp(
                              PiPnpRtlCtx,
                              *(const wchar_t **)(*(_QWORD *)(a1 + 16) + 48i64),
                              (__int64)Handle,
                              *v15,
                              (__int64)&NumberOfBytes + 4,
                              (__int64)v5,
                              (__int64)&NumberOfBytes,
                              0);
            if( DeviceRegProp == -1073741789 )
            {
              ExFreePoolWithTag(v5, 0);
              v26 = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x6E697050ui64);
              v16 = NumberOfBytes;
              v5 = v26;
              if( !v26 )
                DeviceRegProp = -1073741670;
            }
            else if( DeviceRegProp >= 0 )
            {
              if( HIDWORD(NumberOfBytes) == 7 )
                DeviceRegProp = PipFindDeviceOverrideEntry((PWCHAR)v5, v20);
              else
                DeviceRegProp = -1073741823;
            }
          }
          LODWORD(NumberOfBytes) = v16;
          if( DeviceRegProp >= 0 )
            break;
          ++v15;
          v17 = v16;
        }
        if( v5 )
          ExFreePoolWithTag(v5, 0);
        ZwClose(Handle);
        v21 = *(_QWORD *)(a1 + 16);
        v22 = *(_BYTE *)(v21 + 680);
        if( (v22 & 1) == 0 )
        {
          if( DeviceRegProp >= 0 )
          {
            *(_BYTE *)(v21 + 680) = v22 | 4;
            v21 = *(_QWORD *)(a1 + 16);
          }
          *(_BYTE *)(v21 + 680) |= 1u;
        }
        v6 = v39;
        v4 = v31;
      }
      if( DeviceRegProp < 0 )
        return(unsigned int)DeviceRegProp;
    }
    KeyHandle = 0i64;
    if( LODWORD(RootHandle[1]) != 1 )
      goto LABEL_50;
    *(&ObjectAttributes.Length + 1) = 0;
    memset(&ObjectAttributes.Attributes + 1, 0, 20);
    ObjectAttributes.RootDirectory = RootHandle[0];
    *(_DWORD *)&ValueName.Length = 262146;
    ObjectAttributes.ObjectName = &ValueName;
    ValueName.Buffer = (wchar_t *)L"*";
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    DeviceRegProp = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
    if( DeviceRegProp < 0 )
    {
LABEL_50:
      DeviceRegProp = PnpGetDeviceLocationStrings(a1, (__int64 *)&P, &v35);
      if( DeviceRegProp < 0
        || (DeviceRegProp = PnpOpenFirstMatchingSubKey((WCHAR *)P, RootHandle[0], v27),
            ExFreePoolWithTag(P, 0),
            DeviceRegProp < 0) )
      {
        if( LODWORD(RootHandle[1]) > 1 )
        {
          *(&ObjectAttributes.Length + 1) = 0;
          memset(&ObjectAttributes.Attributes + 1, 0, 20);
          KeyHandle = 0i64;
          ObjectAttributes.RootDirectory = RootHandle[0];
          ObjectAttributes.ObjectName = &ValueName;
          *(_DWORD *)&ValueName.Length = 262146;
          ValueName.Buffer = (wchar_t *)L"*";
          ObjectAttributes.Length = 48;
          ObjectAttributes.Attributes = 576;
          DeviceRegProp = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
        }
      }
    }
    ZwClose(RootHandle[0]);
    if( DeviceRegProp >= 0 )
    {
      *(_DWORD *)&ValueName.Length = 1310738;
      ValueName.Buffer = L"Removable";
      DeviceRegProp = ZwQueryValueKey(
                        KeyHandle,
                        &ValueName,
                        KeyValuePartialInformation,
                        KeyValueInformation,
                        0x14u,
                        &ResultLength);
      if( DeviceRegProp >= 0 )
      {
        if( v42 == 4 && v43 == 4 )
          v4 = v44;
        else
          DeviceRegProp = -1073741823;
      }
      ZwClose(KeyHandle);
      *v6 = v4 != 0;
    }
  }
  return(unsigned int)DeviceRegProp;
}

Referenced by: