PnpProcessTargetDeviceEvent
__int64 __fastcall PnpProcessTargetDeviceEvent(const VOID **a1){
unsigned int v1;
_QWORD *v2;
__int64 v4;
__int64 v5;
__int64 v6;
_QWORD *v7;
__int64 v8;
__int64 v9;
__int64 v10;
__int64 v12;
__int64 v13;
HPNPOPCTX *hPnpOpCtx;
hPnpOpCtx = 0i64;
v1 = 0;
v2 = *a1;
v4 = *((_QWORD *)*a1 + 19);
if( v4 )
v5 = *(_QWORD *)(*(_QWORD *)(v4 + 312) + 40i64);
else
v5 = 0i64;
PiPnpRtlBeginOperation(&hPnpOpCtx);
v7 = v2 + 14;
v8 = v2[14] - *(_QWORD *)&GUID_DEVICE_QUERY_AND_REMOVE.Data1;
if( !v8 )
v8 = v2[15] - *(_QWORD *)GUID_DEVICE_QUERY_AND_REMOVE.Data4;
if( !v8 )
goto LABEL_17;
v9 = *v7 - *(_QWORD *)&GUID_DEVICE_EJECT.Data1;
if( *v7 == *(_QWORD *)&GUID_DEVICE_EJECT.Data1 )
v9 = v2[15] - *(_QWORD *)GUID_DEVICE_EJECT.Data4;
if( v9 )
{
v10 = *v7 - *(_QWORD *)&GUID_DEVICE_ARRIVAL.Data1;
if( *v7 == *(_QWORD *)&GUID_DEVICE_ARRIVAL.Data1 )
v10 = v2[15] - *(_QWORD *)GUID_DEVICE_ARRIVAL.Data4;
if( v10 )
{
memcmp(v7, &GUID_DEVICE_NOOP, 0x10ui64);
v1 = 0;
}
else
{
PiUEventNotifyUserMode((__int64)v2);
}
}
else
{
LABEL_17:
if( (byte_140C130BB & 8) != 0 )
McTemplateK0z_EtwWriteTransfer(
(__int64)v7,
(const _EVENT_DESCRIPTOR *)KMPnPEvt_DeviceRemoval_Start,
v6,
*(const wchar_t **)(v5 + 48));
v1 = PnpProcessQueryRemoveAndEject(a1);
if( (byte_140C130BB & 8) != 0 )
McTemplateK0z_EtwWriteTransfer(
v12,
(const _EVENT_DESCRIPTOR *)KMPnPEvt_DeviceRemoval_Stop,
v13,
*(const wchar_t **)(v5 + 48));
}
if( hPnpOpCtx )
PiPnpRtlEndOperation(hPnpOpCtx);
return v1;
}Referenced by:
PnpDeviceEventWorker