PiPnpRtlEndOperation

VOID __stdcall PiPnpRtlEndOperation(PVOID P){
  _ETHREAD *CurrentThread; 
  _ETHREAD *v4; 
  INT64 v5; 
  _QWORD *v6; 
  PVOID *v7; 
  _PI_PNPRTL_OBJECT_EVENT **v8; 
  _PI_PNPRTL_OBJECT_EVENT *v9; 
  _PI_PNPRTL_OBJECT_EVENT *v10; 
  _PI_PNPRTL_OBJECT_EVENT *v11; 
  _PI_PNPRTL_OBJECT_EVENT *ObjectEvent; 

  ObjectEvent = 0i64;
  if( (*((_DWORD *)P + 36))-- == 1 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceSharedLite((UINT64)&PnpReplaceEvent + 3456, 1);
    v4 = (_ETHREAD *)KeGetCurrentThread();
    --v4->Tcb.KernelApcDisable;
    ExAcquireResourceExclusiveLite((UINT64)&PnpReplaceEvent + 3584, 1, v5);
    v6 = *(_QWORD **)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P || (v7 = (PVOID *)*((_QWORD *)P + 1), *v7 != P) )
LABEL_16:
      __fastfail(3u);
    *v7 = v6;
    v6[1] = v7;
    ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3584));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    while( !(unsigned __int8)RtlIsGenericTableEmptyAvl((PRTL_AVL_TABLE)((char *)P + 24)) )
    {
      v10 = *(_PI_PNPRTL_OBJECT_EVENT **)(*((_QWORD *)P + 5) + 32i64);
      ObjectEvent = v10;
      if( *((_QWORD *)v10 + 2) )
      {
        ZwClose(*((_QWORD *)v10 + 2));
        *((_QWORD *)ObjectEvent + 2) = 0i64;
        v10 = ObjectEvent;
      }
      PiPnpRtlObjectEventDispatch(v10);
      RtlDeleteElementGenericTableAvl((PRTL_AVL_TABLE)((char *)P + 24), &ObjectEvent);
      PiPnpRtlObjectEventRelease(ObjectEvent);
    }
    ExReleaseResourceLite((PERESOURCE)((char *)&PnpReplaceEvent + 3456));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    v8 = (_PI_PNPRTL_OBJECT_EVENT **)((char *)P + 128);
    while( 1 )
    {
      v9 = *v8;
      if( *v8 == (_PI_PNPRTL_OBJECT_EVENT *)v8 )
        break;
      if( *((_PI_PNPRTL_OBJECT_EVENT ***)v9 + 1) != v8 )
        goto LABEL_16;
      v11 = *(_PI_PNPRTL_OBJECT_EVENT **)v9;
      if( *(_PI_PNPRTL_OBJECT_EVENT **)(*(_QWORD *)v9 + 8i64) != v9 )
        goto LABEL_16;
      *v8 = v11;
      *((_QWORD *)v11 + 1) = v8;
      ObjectEvent = v9 - 14;
      PiPnpRtlObjectEventRelease(v9 - 14);
    }
    ExFreePoolWithTag(P, 0x41706E50u);
  }
}

Referenced by: