PiDqQueryApplyObjectEvent
CHAR __fastcall PiDqQueryApplyObjectEvent(INT64 a1, INT64 a2){
int v2;
int AddObjectToResultSet;
char v6;
char v7;
UINT8 v8;
__int64 v9;
int v10;
int v11;
unsigned int v12;
unsigned int v13;
__int64 v14;
__int64 v15;
__int64 v16;
unsigned int v17;
__int64 v18;
unsigned int v19;
__int64 v20;
__int64 v21;
__int64 v22;
bool v23;
_ETHREAD *CurrentThread;
__int64 v25;
bool v26;
bool v27;
bool v28;
int v29;
_ETHREAD *v30;
__int64 v31;
const wchar_t *v32;
const wchar_t *v33;
__int64 v34;
const wchar_t *v35;
const wchar_t *v36;
unsigned int v37;
unsigned int v38;
__int64 v39;
__int64 v40;
__int64 v41;
int v42;
__int64 v43;
int v44;
_ETHREAD *v45;
_ETHREAD *v46;
unsigned int v47;
__int64 v48;
const wchar_t *i;
__int64 v50;
const wchar_t *v51;
__int64 v52;
int v53;
const wchar_t *v54;
__int64 v55;
_ETHREAD *v56;
__int64 v58;
__int64 Buffer;
char v60;
BOOL v61;
UINT8 IsSameUser;
v2 = *(_DWORD *)(a2 + 4);
v61 = 0;
v58 = 0i64;
AddObjectToResultSet = 0;
v60 = 0;
v6 = 0;
IsSameUser = 0;
v7 = 0;
v8 = 0;
if( (v2 & 3) != 0 || (v2 & 8) == 0 && !*(_DWORD *)(a2 + 76) )
goto LABEL_25;
if( (v2 & 4) != 0 )
{
v61 = PiDqSameUserHive((SECURITY_SUBJECT_CONTEXT *)(a1 + 32), (SECURITY_SUBJECT_CONTEXT *)(a2 + 24), &IsSameUser);
if( v61 < 0 )
goto LABEL_139;
v8 = IsSameUser;
v6 = 0;
}
v9 = *(_QWORD *)(a1 + 24);
v10 = *(_DWORD *)(v9 + 40) & 4;
if( (*(_DWORD *)(v9 + 40) & 2) != 0 )
{
if( !v10 )
{
LABEL_52:
LOBYTE(AddObjectToResultSet) = 1;
v60 = 1;
goto LABEL_13;
}
v47 = 0;
if( !*(_DWORD *)(a2 + 76) )
goto LABEL_36;
while( 1 )
{
v48 = 32i64 * v47;
if( *(_DWORD *)(v48 + a2 + 100) != 1 || v8 )
{
if( !*(_QWORD *)(v48 + a2 + 104) )
goto LABEL_52;
for( i = *(const wchar_t **)(*(_QWORD *)(a1 + 24) + 56i64); *i; i += v50 + 1 )
{
if( !wcsicmp(*(const wchar_t **)(v48 + a2 + 104), i) )
goto LABEL_52;
v50 = -1i64;
do
++v50;
while( i[v50] );
}
}
if( ++v47 >= *(_DWORD *)(a2 + 76) )
break;
v8 = IsSameUser;
}
}
else
{
v11 = *(_DWORD *)(v9 + 64);
if( !v10 )
{
v12 = 0;
if( v11 )
{
do
{
v13 = 0;
v14 = *(_QWORD *)(v9 + 72) + 32i64 * v12;
if( *(_DWORD *)(a2 + 76) )
{
while( 1 )
{
v15 = 32i64 * v13;
if( *(_DWORD *)(v14 + 16) == *(_DWORD *)(v15 + a2 + 96) )
{
v31 = *(_QWORD *)v14 - *(_QWORD *)(v15 + a2 + 80);
if( *(_QWORD *)v14 == *(_QWORD *)(v15 + a2 + 80) )
v31 = *(_QWORD *)(v14 + 8) - *(_QWORD *)(v15 + a2 + 88);
if( !v31 && *(_DWORD *)(v14 + 20) == *(_DWORD *)(v15 + a2 + 100) )
{
v32 = *(const wchar_t **)(v14 + 24);
v33 = *(const wchar_t **)(v15 + a2 + 104);
if( (v32 == v33 || v32 && v33 && !wcsicmp(v32, v33))
&& (*(_DWORD *)(v15 + a2 + 100) != 1 || IsSameUser) )
{
break;
}
}
}
if( ++v13 >= *(_DWORD *)(a2 + 76) )
goto LABEL_11;
}
LOBYTE(AddObjectToResultSet) = 1;
v60 = 1;
}
else
{
LABEL_11:
LOBYTE(AddObjectToResultSet) = v60;
}
v9 = *(_QWORD *)(a1 + 24);
++v12;
}
while( v12 < *(_DWORD *)(v9 + 64) );
goto LABEL_13;
}
LABEL_36:
LOBYTE(AddObjectToResultSet) = 0;
goto LABEL_13;
}
v37 = 0;
if( !v11 )
goto LABEL_36;
while( 1 )
{
v38 = 0;
v39 = *(_QWORD *)(v9 + 72) + 32i64 * v37;
if( *(_DWORD *)(a2 + 76) )
break;
LABEL_57:
v9 = *(_QWORD *)(a1 + 24);
if( ++v37 >= *(_DWORD *)(v9 + 64) )
goto LABEL_74;
v8 = IsSameUser;
}
while( 1 )
{
v40 = 32i64 * v38;
if( *(_DWORD *)(v39 + 16) == *(_DWORD *)(v40 + a2 + 96) )
{
v43 = *(_QWORD *)v39 - *(_QWORD *)(v40 + a2 + 80);
if( *(_QWORD *)v39 == *(_QWORD *)(v40 + a2 + 80) )
v43 = *(_QWORD *)(v39 + 8) - *(_QWORD *)(v40 + a2 + 88);
if( !v43 )
{
v44 = *(_DWORD *)(v40 + a2 + 100);
if( *(_DWORD *)(v39 + 20) == v44 && (v44 != 1 || v8) )
{
if( !*(_QWORD *)(v40 + a2 + 104) )
goto LABEL_52;
v51 = *(const wchar_t **)(*(_QWORD *)(a1 + 24) + 56i64);
if( *v51 )
{
while( wcsicmp(*(const wchar_t **)(v40 + a2 + 104), v51) )
{
v52 = -1i64;
do
++v52;
while( v51[v52] );
v51 += v52 + 1;
if( !*v51 )
{
v6 = v60;
goto LABEL_112;
}
}
v6 = 1;
v60 = 1;
}
LABEL_112:
if( v6 )
break;
}
}
}
v8 = IsSameUser;
if( ++v38 >= *(_DWORD *)(a2 + 76) )
goto LABEL_57;
}
LABEL_74:
LOBYTE(AddObjectToResultSet) = v60;
}
LABEL_13:
v16 = *(_QWORD *)(a1 + 24);
if( !*(_DWORD *)(v16 + 20) && (LODWORD(v16) = *(_DWORD *)(a2 + 4), (v16 & 8) != 0) )
{
v7 = 1;
}
else
{
v17 = 0;
v7 = 0;
do
{
if( v17 >= *(_DWORD *)(a2 + 76) )
break;
v18 = *(_QWORD *)(a1 + 24);
v19 = 0;
v20 = 32i64 * v17;
if( *(_DWORD *)(v18 + 80) )
{
while( 1 )
{
v21 = *(_QWORD *)(v18 + 88);
v22 = 56i64 * v19;
LODWORD(v16) = *(_DWORD *)(v20 + a2 + 96);
if( *(_DWORD *)(v22 + v21 + 24) == (_DWORD)v16 )
{
v34 = *(_QWORD *)(v22 + v21 + 8) - *(_QWORD *)(v20 + a2 + 80);
if( !v34 )
v34 = *(_QWORD *)(v22 + v21 + 16) - *(_QWORD *)(v20 + a2 + 88);
if( !v34 )
{
LODWORD(v16) = *(_DWORD *)(v20 + a2 + 100);
if( *(_DWORD *)(v22 + v21 + 28) == (_DWORD)v16 )
{
v35 = *(const wchar_t **)(v22 + v21 + 32);
v36 = *(const wchar_t **)(v20 + a2 + 104);
if( v35 == v36 || v35 && v36 && (LODWORD(v16) = wcsicmp(v35, v36), !(_DWORD)v16) )
{
if( *(_DWORD *)(v20 + a2 + 100) != 1 || IsSameUser )
break;
}
}
}
}
v18 = *(_QWORD *)(a1 + 24);
if( ++v19 >= *(_DWORD *)(v18 + 80) )
goto LABEL_20;
}
v7 = 1;
}
LABEL_20:
++v17;
}
while( !v7 );
}
v23 = (_BYTE)AddObjectToResultSet == 0;
AddObjectToResultSet = v61;
if( v23 && !v7 )
{
LABEL_23:
if( AddObjectToResultSet >= 0 )
return v16;
goto LABEL_139;
}
LABEL_25:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
Buffer = *(_QWORD *)(a2 + 8);
LODWORD(v25) = RtlLookupElementGenericTableAvl((RTL_AVL_TABLE *)(a1 + 72), &Buffer);
v26 = v25 != 0;
ExReleasePushLockEx(a1 + 64, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LODWORD(v16) = *(_DWORD *)(a2 + 4);
if( (v16 & 2) != 0 )
{
if( !v26 )
{
v28 = 0;
v29 = 0;
goto LABEL_32;
}
LABEL_87:
v45 = (_ETHREAD *)KeGetCurrentThread();
v29 = 3;
v28 = 1;
--*((_WORD *)v45 + 242);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
PiDqQueryDeleteObjectFromResultSet(a1, *(_QWORD *)(a2 + 8));
ExReleasePushLockEx(a1 + 64, 0i64);
LOBYTE(v16) = (unsigned __int8)KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
goto LABEL_32;
}
if( (v16 & 1) == 0 && !v7 )
{
v27 = v26;
goto LABEL_29;
}
v41 = *(_QWORD *)(a1 + 24);
v42 = *(_DWORD *)(v41 + 20);
if( !v42 )
{
v27 = 1;
LABEL_61:
LOBYTE(v16) = v27;
LOBYTE(v61) = v27;
LABEL_62:
if( !(_BYTE)v16 )
goto LABEL_30;
goto LABEL_63;
}
v53 = v42 - 1;
if( !v53 )
{
v27 = wcsicmp(*(const wchar_t **)(v41 + 24), *(const wchar_t **)(*(_QWORD *)(a2 + 8) + 16i64)) == 0;
goto LABEL_61;
}
if( v53 != 1 )
goto LABEL_30;
v54 = *(const wchar_t **)(v41 + 32);
v27 = 0;
LOBYTE(v61) = 0;
if( !*v54 )
goto LABEL_30;
LOBYTE(v16) = 0;
while( !(_BYTE)v16 )
{
v27 = wcsicmp(v54, *(const wchar_t **)(*(_QWORD *)(a2 + 8) + 16i64)) == 0;
v55 = -1i64;
LOBYTE(v16) = v27;
LOBYTE(v61) = v27;
do
++v55;
while( v54[v55] );
v54 += v55 + 1;
if( !*v54 )
goto LABEL_62;
}
LABEL_63:
v16 = *(_QWORD *)(a1 + 24);
if( !*(_DWORD *)(v16 + 20) )
{
PiPnpRtlApplyMandatoryFilters();
AddObjectToResultSet = v16;
if( (_DWORD)v16 == -1073741772 || (_DWORD)v16 == -1073741275 )
{
v27 = 0;
AddObjectToResultSet = 0;
LOBYTE(v61) = 0;
}
else
{
v27 = v61;
}
if( AddObjectToResultSet < 0 )
goto LABEL_139;
}
if( !v27 )
goto LABEL_30;
v16 = *(_QWORD *)(a1 + 24);
if( *(_QWORD *)(v16 + 88) )
{
LODWORD(v16) = PiDqQueryEvaluateFilter(a1, *(_QWORD *)(*(_QWORD *)(a2 + 8) + 16i64), &v61);
AddObjectToResultSet = v16;
if( (_DWORD)v16 == -1073741772 )
{
v27 = 0;
AddObjectToResultSet = 0;
}
else
{
v27 = v61;
}
if( AddObjectToResultSet < 0 )
goto LABEL_139;
}
LABEL_29:
if( v27 )
{
if( v26 )
{
v29 = 2;
v28 = v60 != 0;
}
else
{
v46 = (_ETHREAD *)KeGetCurrentThread();
v29 = 1;
--*((_WORD *)v46 + 242);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
AddObjectToResultSet = PiDqQueryAddObjectToResultSet(a1, *(_QWORD *)(a2 + 8));
ExReleasePushLockEx(a1 + 64, 0i64);
LOBYTE(v16) = (unsigned __int8)KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v28 = 1;
}
goto LABEL_32;
}
LABEL_30:
if( v26 )
goto LABEL_87;
v28 = 0;
v29 = 0;
LABEL_32:
if( AddObjectToResultSet >= 0 )
{
if( !v28 )
goto LABEL_23;
AddObjectToResultSet = PiDqQueryActionQueueEntryCreate(
v29,
*(_QWORD *)(a2 + 8),
(volatile signed __int32 *)a2,
&v58);
if( AddObjectToResultSet >= 0 )
{
v30 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v30 + 242);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
PiDqQueryAppendActionEntry(a1, v58);
ExReleasePushLockEx(a1 + 64, 0i64);
LOBYTE(v16) = (unsigned __int8)KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
goto LABEL_23;
}
}
LABEL_139:
v56 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v56 + 242);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
*(_DWORD *)(a1 + 216) |= 1u;
PiDqQueryFreeActiveData(a1);
ExReleasePushLockEx(a1 + 64, 0i64);
LOBYTE(v16) = (unsigned __int8)KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v16;
}Referenced by:
PiDqObjectManagerServiceActionQueue