PipSendTargetDeviceQueryRemoveNotification
__int64 __fastcall PipSendTargetDeviceQueryRemoveNotification(__int64 a1, __int64 a2, _UNICODE_STRING *a3, __int64 a4){
unsigned int v5;
unsigned int v8;
int v9;
_DEVICE_OBJECT **i;
_DEVICE_OBJECT *v11;
_DWORD *DeviceNode;
int v13;
__int64 v15;
_WORD *v16;
__int64 v17[7];
v17[0] = 0i64;
v5 = (unsigned int)a3;
v8 = 0;
v9 = 0;
if( !(_DWORD)a3 )
return v8;
for( i = (_DEVICE_OBJECT **)a2; ; ++i )
{
v11 = *i;
if( *i )
DeviceNode = v11->DeviceObjectExtension->DeviceNode;
else
DeviceNode = 0i64;
if( DeviceNode )
{
v13 = DeviceNode[75];
if( ((v13 - 769) & 0xFFFFFFEE) == 0 && v13 != 785 )
goto LABEL_9;
}
if( *(_BYTE *)(a1 + 72) )
break;
v8 = PnpNotifyTargetDeviceChange(&GUID_TARGET_DEVICE_QUERY_REMOVE, v11, 0i64, v17);
if( (v8 & 0x80000000) != 0 )
goto LABEL_15;
LABEL_9:
if( ++v9 >= v5 )
return v8;
}
v8 = -1073741536;
LABEL_15:
v15 = v17[0];
v16 = (_WORD *)(a4 + 8);
*(_DWORD *)a4 = 7;
if( v15 )
{
RtlCopyUnicodeString((PUNICODE_STRING)(a4 + 8), (PCUNICODE_STRING)(v15 + 56));
}
else
{
memset(*(VOID **)(a4 + 16), 0i64, (unsigned __int16)*v16);
*v16 = 0;
}
if( v9 )
PiSendTargetDeviceRemoveCanceledNotification(a2, v9 - 1);
return v8;
}Referenced by:
PipProcessQueryRemovalInKernelMode