PiProcessQueryAndCancelRemoval

INT64 __fastcall PiProcessQueryAndCancelRemoval(
        INT64 a1,
        INT64 a2,
        UINT64 **a3,
        UINT64 a4,
        VOID **a5,
        INT64 *a6,
        const VOID **a7){
  unsigned int v9; 
  CHAR v10; 
  unsigned int v11; 
  CHAR *v12; 
  _UNICODE_STRING *v13; 
  int RemovalInKernelMode; 
  __int64 v16; 
  char *v17; 
  __int64 v18; 
  __int64 v19; 
  CHAR *CriticalMemory; 
  CHAR v21; 
  int v22[3]; 
  unsigned int v23; 
  v23 = a4;
  v9 = a1;
  v22[0] = 0;
  v10 = PiEventAreDeviceRelationsExcluded(a1);
  v12 = (CHAR *)v11;
  v21 = v10;
  v13 = (_UNICODE_STRING *)(a6 + 1);
  RemovalInKernelMode = PnpNotifyUserModeDeviceRemoval(
                          a2,
                          *a7,
                          (__int128 *)&GUID_TARGET_DEVICE_QUERY_REMOVE,
                          (__int64)a6,
                          (__int64)(a6 + 1),
                          v22);
  if( RemovalInKernelMode < 0 )
  {
    PnpFinalizeVetoedRemove((_PNP_DEVICE_EVENT_ENTRY *)a2, *(_PNP_VETO_TYPE *)a6, v13);
    if( !v22[0] )
      return(unsigned int)RemovalInKernelMode;
    v16 = (unsigned int)v22[0];
    v17 = (char *)*a7;
    do
    {
      v18 = -1i64;
      do
        ++v18;
      while( *(_WORD *)&v17[2 * v18] );
      v17 += 2 * v18 + 2;
      --v16;
    }
    while( v16 );
    v19 = (v17 - (_BYTE *)*a7) >> 1;
    CriticalMemory = PnpAllocateCriticalMemory(v9, PagedPool, 2i64 * (unsigned int)(v19 + 1), 0x4B706E50ui64);
    v12 = CriticalMemory;
    if( !CriticalMemory )
      return(unsigned int)-1073741670;
    memmove((UINT8 *)CriticalMemory, (UINT8 *)*a7, 2i64 * (unsigned int)v19);
    *(_WORD *)&v12[2 * (unsigned int)(v19 + 1) - 2] = 0;
    PnpNotifyUserModeDeviceRemoval(a2, v12, (__int128 *)GUID_TARGET_DEVICE_REMOVE_CANCELLED, 0i64, 0i64, 0i64);
    goto LABEL_15;
  }
  RemovalInKernelMode = PipProcessQueryRemovalInKernelMode(v9, a2, (INT64)a3, v23, a5, (INT64)a6);
  if( RemovalInKernelMode < 0 )
  {
    PnpFinalizeVetoedRemove((_PNP_DEVICE_EVENT_ENTRY *)a2, *(_PNP_VETO_TYPE *)a6, v13);
    PnpNotifyUserModeDeviceRemoval(a2, *a7, (__int128 *)GUID_TARGET_DEVICE_REMOVE_CANCELLED, 0i64, 0i64, 0i64);
    return(unsigned int)RemovalInKernelMode;
  }
  if( *(_DWORD *)(a2 + 16) == 54 )
  {
    RemovalInKernelMode = PnpCancelRemoveOnHungDevices(a2, v9, v21, a3, (CHAR **)a7);
LABEL_15:
    if( v12 )
      ExFreePoolWithTag(v12, 0x4B706E50u);
  }
  return(unsigned int)RemovalInKernelMode;
}

Referenced by: