PnpAsynchronousCall

__int64 __fastcall PnpAsynchronousCall(
        _DEVICE_OBJECT *a1,
        __int128 *a2,
        int (__fastcall *a3)(_DEVICE_OBJECT *, _IRP *, void *),
        void *a4){
  _BYTE *v8; 
  VOID *v9; 
  INT64 v10; 
  VOID **Irp; 
  UINT64 v12; 
  _QWORD *DeviceNode; 
  __int128 v14; 
  _ETHREAD *CurrentThread; 
  __int128 v16; 
  __int64 v17; 
  __int128 v18; 
  __int128 v19; 
  __int64 v20; 
  unsigned int v21; 

  LODWORD(v8) = IoGetAttachedDeviceReferenceWithTag(a1, 0x69706E50u);
  v9 = v8;
  LOBYTE(v10) = v8[76];
  Irp = IoAllocateIrp(v10, 0);
  v12 = (UINT64)Irp;
  if( Irp )
  {
    IovUtilWatermarkIrp((_IRP *)Irp, 1ui64);
    if( a1 )
      DeviceNode = a1->DeviceObjectExtension->DeviceNode;
    else
      DeviceNode = 0i64;
    if( DeviceNode )
      DeviceNode[9] = v12;
    *(_QWORD *)(v12 + 56) = 0i64;
    v14 = *a2;
    *(_DWORD *)(v12 + 48) = -1073741637;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    *(_QWORD *)(v12 + 72) = 0i64;
    *(_QWORD *)(v12 + 80) = 0i64;
    v16 = a2[1];
    *(_QWORD *)(v12 + 152) = CurrentThread;
    v17 = *(_QWORD *)(v12 + 184);
    *(_BYTE *)(v12 + 64) = 0;
    *(_OWORD *)(v17 - 72) = v14;
    v18 = a2[2];
    *(_OWORD *)(v17 - 56) = v16;
    v19 = a2[3];
    *(_OWORD *)(v17 - 40) = v18;
    *(_QWORD *)&v18 = *((_QWORD *)a2 + 8);
    *(_OWORD *)(v17 - 24) = v19;
    *(_QWORD *)(v17 - 8) = v18;
    v20 = *(_QWORD *)(v12 + 184);
    *(_QWORD *)(v20 - 16) = a3;
    *(_QWORD *)(v20 - 8) = a4;
    *(_BYTE *)(v20 - 69) = -32;
    v21 = IofCallDriver((UINT64)v9, v12);
  }
  else
  {
    v21 = -1073741670;
  }
  ObfDereferenceObjectWithTag(v9, 0x69706E50ui64);
  return v21;
}

Referenced by:

PiIrpQueryRemoveDevice
PnpSendIrp