PiUEventNotifyUserMode
__int64 __fastcall PiUEventNotifyUserMode(__int64 a1){
unsigned int v2;
char v3;
__int64 v4;
bool IsDeviceEventVetoable;
bool v6;
VOID *PoolWithTag;
INT64 v8;
_FAST_MUTEX *v9;
_DWORD *v10;
__int64 v11;
INT64 *v12;
PVOID *v13;
WORK_QUEUE_ITEM *v14;
WCHAR *v16;
_KEVENT *v17;
int v18;
int v19;
__int64 v20;
__int64 v21;
_QWORD *v22;
PVOID Object[2];
UINT8 DeviceNeedsInstall;
size_t Size;
union _LARGE_INTEGER Timeout;
v2 = 0;
v3 = 0;
DeviceNeedsInstall = 0;
if( PnpShutdownEvent.Header.SignalState )
return(unsigned int)-1073741431;
if( *(_DWORD *)(a1 + 128) == 4 )
{
v16 = (WCHAR *)(a1 + 160);
if( PiUEventDeviceNeedsInstall((PWCHAR)(a1 + 160), &DeviceNeedsInstall) >= 0 )
{
if( DeviceNeedsInstall )
PiUEventSendDeviceInstallNotification(v16);
}
}
if( PiUEventShouldQueueEvent((_PNP_DEVICE_EVENT_ENTRY *)a1) )
{
IsDeviceEventVetoable = PiUEventIsDeviceEventVetoable(v4);
LODWORD(Size) = *(_DWORD *)(a1 + 148) + 72;
v6 = IsDeviceEventVetoable;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)Size, 0x59706E50ui64);
v8 = (INT64)PoolWithTag;
if( !PoolWithTag )
return(unsigned int)-1073741670;
memset((INT64)PoolWithTag, 0i64);
v9 = (_FAST_MUTEX *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x38ui64, 0x59706E50ui64);
*(_QWORD *)(v8 + 16) = v9;
if( !v9 )
{
LABEL_38:
PiUEventFreeEventEntry((PVOID)v8);
return(unsigned int)-1073741670;
}
KeInitializeGuardedMutex(v9);
*(_DWORD *)(v8 + 56) = 1;
*(_BYTE *)(v8 + 69) = v6;
v10 = *(_DWORD **)(a1 + 48);
if( v6 )
{
*(_QWORD *)(v8 + 32) = v10;
v20 = *(_QWORD *)(a1 + 56);
*(_QWORD *)(v8 + 40) = v20;
**(_WORD **)(v20 + 8) = 0;
**(_WORD **)(v8 + 40) = 0;
**(_DWORD **)(v8 + 32) = 0;
}
else
{
if( v10 )
*v10 = 0;
v11 = *(_QWORD *)(a1 + 56);
if( v11 )
{
**(_WORD **)(v11 + 8) = 0;
**(_WORD **)(a1 + 56) = 0;
}
}
if( *(_QWORD *)(a1 + 24) || v6 )
{
v3 = 1;
v17 = (_KEVENT *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x18ui64, 0x59706E50ui64);
*(_QWORD *)(v8 + 24) = v17;
if( !v17 )
{
LABEL_36:
if( *(_QWORD *)(v8 + 24) )
PiUEventDereferenceEventEntry(v8);
goto LABEL_38;
}
KeInitializeEvent(v17, NotificationEvent, 0);
PiUEventReferenceEventEntry(v8);
}
*(_BYTE *)(v8 + 68) = v3;
*(_DWORD *)(v8 + 64) = *(_DWORD *)(a1 + 148) + 8;
memmove((UINT8 *)(v8 + 72), (UINT8 *)(a1 + 112), *(unsigned int *)(a1 + 148));
PiUEventCacheObjectProperties(v8);
ExAcquireFastMutex(&PiUEventUsermodeEventQueueLock);
v12 = (INT64 *)qword_140C45028;
v13 = (PVOID *)PiUEventUsermodeEventQueue;
if( *(PVOID **)qword_140C45028 != &PiUEventUsermodeEventQueue )
goto LABEL_42;
*(_QWORD *)v8 = &PiUEventUsermodeEventQueue;
*(_QWORD *)(v8 + 8) = v12;
*v12 = v8;
qword_140C45028 = v8;
KeReleaseGuardedMutex(&PiUEventUsermodeEventQueueLock);
if( v13 != &PiUEventUsermodeEventQueue )
goto LABEL_17;
v14 = (WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x20ui64, 0x59706E50ui64);
if( v14 )
{
v14->Parameter = v14;
v14->WorkerRoutine = (void(__fastcall *)(void *))PiUEventProcessEventWorker;
v14->List.Flink = 0i64;
ExQueueWorkItem(v14, NormalWorkQueue);
LABEL_17:
if( v3 )
{
Object[0] = &PnpShutdownEvent;
Object[1] = *(PVOID *)(v8 + 24);
Timeout.QuadPart = -300000000i64;
KeWaitForMultipleObjects((_BYTE *)2, Object, WaitAny, Executive, 0, 1u, &Timeout, 0i64);
LODWORD(Size) = 0;
v19 = v18;
ZwUpdateWnfStateData();
if( v19 )
{
if( v19 == 1 )
{
if( v6 && **(_DWORD **)(a1 + 48) )
v2 = -1073741536;
else
v2 = 0;
}
else
{
v2 = v19 != 258 ? 0xC0000001 : 0;
}
}
else
{
v2 = -1073741431;
}
ExAcquireFastMutex(&PiUEventUsermodeEventQueueLock);
*(_QWORD *)(v8 + 32) = 0i64;
*(_QWORD *)(v8 + 40) = 0i64;
KeReleaseGuardedMutex(&PiUEventUsermodeEventQueueLock);
PiUEventDereferenceEventEntry(v8);
}
return v2;
}
ExAcquireFastMutex(&PiUEventUsermodeEventQueueLock);
v21 = *(_QWORD *)v8;
if( *(_QWORD *)(*(_QWORD *)v8 + 8i64) != v8 || (v22 = *(_QWORD **)(v8 + 8), *v22 != v8) )
LABEL_42:
__fastfail(3u);
*v22 = v21;
*(_QWORD *)(v21 + 8) = v22;
KeReleaseGuardedMutex(&PiUEventUsermodeEventQueueLock);
if( !v3 )
goto LABEL_38;
goto LABEL_36;
}
return v2;
}Referenced by:
PnpDeviceEventWorker
PnpNotifyUserModeDeviceRemoval
PnpProcessCustomDeviceEvent
PnpProcessTargetDeviceEvent