PipSendTargetDeviceQueryRemoveNotification

__int64 __fastcall PipSendTargetDeviceQueryRemoveNotification(__int64 a1, __int64 a2, _UNICODE_STRING *a3, __int64 a4){
  unsigned int v5; 
  unsigned int v8; 
  int v9; 
  _DEVICE_OBJECT **i; 
  _DEVICE_OBJECT *v11; 
  _DWORD *DeviceNode; 
  int v13; 
  __int64 v15; 
  _WORD *v16; 
  __int64 v17[7]; 

  v17[0] = 0i64;
  v5 = (unsigned int)a3;
  v8 = 0;
  v9 = 0;
  if( !(_DWORD)a3 )
    return v8;
  for( i = (_DEVICE_OBJECT **)a2; ; ++i )
  {
    v11 = *i;
    if( *i )
      DeviceNode = v11->DeviceObjectExtension->DeviceNode;
    else
      DeviceNode = 0i64;
    if( DeviceNode )
    {
      v13 = DeviceNode[75];
      if( ((v13 - 769) & 0xFFFFFFEE) == 0 && v13 != 785 )
        goto LABEL_9;
    }
    if( *(_BYTE *)(a1 + 72) )
      break;
    v8 = PnpNotifyTargetDeviceChange(&GUID_TARGET_DEVICE_QUERY_REMOVE, v11, 0i64, v17);
    if( (v8 & 0x80000000) != 0 )
      goto LABEL_15;
LABEL_9:
    if( ++v9 >= v5 )
      return v8;
  }
  v8 = -1073741536;
LABEL_15:
  v15 = v17[0];
  v16 = (_WORD *)(a4 + 8);
  *(_DWORD *)a4 = 7;
  if( v15 )
  {
    RtlCopyUnicodeString((PUNICODE_STRING)(a4 + 8), (PCUNICODE_STRING)(v15 + 56));
  }
  else
  {
    memset(*(VOID **)(a4 + 16), 0i64, (unsigned __int16)*v16);
    *v16 = 0;
  }
  if( v9 )
    PiSendTargetDeviceRemoveCanceledNotification(a2, v9 - 1);
  return v8;
}

Referenced by:

PipProcessQueryRemovalInKernelMode