PnpInsertEventInQueue

__int64 __fastcall PnpInsertEventInQueue(__int64 a1){
  unsigned int v2; 
  _WORK_QUEUE_ITEM *PoolWithTag; 
  _GUID *ActivityIdThread; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 *v8; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  GUID v14; 

  v14 = NullGuid;
  v2 = 0;
  PoolWithTag = 0i64;
  ActivityIdThread = IoGetActivityIdThread();
  if( ActivityIdThread )
  {
    v14 = *ActivityIdThread;
  }
  else if( PnpIsSafeToExamineUserModeTeb()
         && KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self )
  {
    v14 = *(GUID *)&KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self[105].SubSystemTib;
  }
  *(GUID *)(a1 + 88) = v14;
  if( (byte_140C130BB & 8) != 0 )
  {
    v10 = *(_QWORD *)(a1 + 112) - *(_QWORD *)&GUID_DEVICE_QUERY_AND_REMOVE.Data1;
    if( !v10 )
      v10 = *(_QWORD *)(a1 + 120) - *(_QWORD *)GUID_DEVICE_QUERY_AND_REMOVE.Data4;
    if( !v10 )
      goto LABEL_20;
    v11 = *(_QWORD *)(a1 + 112) - *(_QWORD *)&GUID_DEVICE_EJECT.Data1;
    if( !v11 )
      v11 = *(_QWORD *)(a1 + 120) - *(_QWORD *)GUID_DEVICE_EJECT.Data4;
    if( !v11 )
    {
LABEL_20:
      v12 = *(_QWORD *)(a1 + 152);
      if( v12 )
        v13 = *(_QWORD *)(*(_QWORD *)(v12 + 312) + 40i64);
      else
        v13 = 0i64;
      McTemplateK0z_EtwWriteTransfer(
        v5,
        (const _EVENT_DESCRIPTOR *)KMPnPEvt_DeviceRemoval_Queue,
        v6,
        *(const wchar_t **)(v13 + 48));
    }
  }
  ExAcquireFastMutex((PFAST_MUTEX)(PnpDeviceEventList + 64));
  ExAcquireFastMutex((PFAST_MUTEX)((char *)&PnpReplaceEvent + 64));
  if( !BYTE2(NlsMbCodePageTag) )
  {
    PoolWithTag = (_WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(0x200ui64, 0x20ui64, 1282436688i64);
    if( PoolWithTag )
    {
      BYTE2(NlsMbCodePageTag) = 1;
      KeResetEvent((_KEVENT *)((char *)&PnpReplaceEvent + 32));
    }
    else
    {
      v2 = -1073741670;
    }
  }
  v7 = PnpDeviceEventList + 120;
  v8 = *(__int64 **)(PnpDeviceEventList + 128);
  if( *v8 != PnpDeviceEventList + 120 )
    __fastfail(3u);
  *(_QWORD *)a1 = v7;
  *(_QWORD *)(a1 + 8) = v8;
  *v8 = a1;
  *(_QWORD *)(v7 + 8) = a1;
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 64));
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)(PnpDeviceEventList + 64));
  if( PoolWithTag )
  {
    PoolWithTag->WorkerRoutine = PnpDeviceEventWorker;
    PoolWithTag->Parameter = PoolWithTag;
    PoolWithTag->List.Flink = 0i64;
    ExQueueWorkItem(PoolWithTag, DelayedWorkQueue);
  }
  return v2;
}

Referenced by: