PnpInsertEventInQueue

__int64 __fastcall PnpInsertEventInQueue(__int64 a1){
  unsigned int v2; 
  WORK_QUEUE_ITEM *PoolWithTag; 
  const GUID *ActivityIdThread; 
  INT64 v5; 
  INT64 v6; 
  char v7; 
  UINT64 v8; 
  UINT8 v9; 
  UINT8 v10; 
  __int64 v11; 
  __int64 *v12; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  GUID v18; 
  v18 = NullGuid;
  v2 = 0;
  PoolWithTag = 0i64;
  ActivityIdThread = IoGetActivityIdThread();
  if( ActivityIdThread )
  {
    v18 = *ActivityIdThread;
  }
  else
  {
    PnpIsSafeToExamineUserModeTeb(v5);
    if( v7 && *((_QWORD *)KeGetPcr() + 6) )
      v18 = *(GUID *)(*((_QWORD *)KeGetPcr() + 6) + 5904i64);
  }
  *(GUID *)(a1 + 88) = v18;
  if( (byte_140C130BB & 8) != 0 )
  {
    v14 = *(_QWORD *)(a1 + 112) - *(_QWORD *)&GUID_DEVICE_QUERY_AND_REMOVE.Data1;
    if( !v14 )
      v14 = *(_QWORD *)(a1 + 120) - *(_QWORD *)GUID_DEVICE_QUERY_AND_REMOVE.Data4;
    if( !v14 )
      goto LABEL_20;
    v15 = *(_QWORD *)(a1 + 112) - *(_QWORD *)&GUID_DEVICE_EJECT.Data1;
    if( !v15 )
      v15 = *(_QWORD *)(a1 + 120) - *(_QWORD *)GUID_DEVICE_EJECT.Data4;
    if( !v15 )
    {
LABEL_20:
      v16 = *(_QWORD *)(a1 + 152);
      if( v16 )
        v17 = *(_QWORD *)(*(_QWORD *)(v16 + 312) + 40i64);
      else
        v17 = 0i64;
      McTemplateK0z_EtwWriteTransfer(v5, &KMPnPEvt_DeviceRemoval_Queue, v6, *(const WCHAR **)(v17 + 48));
    }
  }
  ExAcquireFastMutex((FAST_MUTEX *)(PnpDeviceEventList + 64));
  ExAcquireFastMutex(&PnpNotificationInProgressLock);
  if( !BYTE2(NlsMbCodePageTag) )
  {
    PoolWithTag = (WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x20ui64, 0x4C706E50ui64);
    if( PoolWithTag )
    {
      BYTE2(NlsMbCodePageTag) = 1;
      KeResetEvent(&PnpEventQueueEmpty, v8, v9, v10, *(IRP **)&v18.Data1);
    }
    else
    {
      v2 = -1073741670;
    }
  }
  v11 = PnpDeviceEventList + 120;
  v12 = *(__int64 **)(PnpDeviceEventList + 128);
  if( *v12 != PnpDeviceEventList + 120 )
    __fastfail(3u);
  *(_QWORD *)a1 = v11;
  *(_QWORD *)(a1 + 8) = v12;
  *v12 = a1;
  *(_QWORD *)(v11 + 8) = a1;
  KeReleaseGuardedMutex(&PnpNotificationInProgressLock);
  KeReleaseGuardedMutex((_FAST_MUTEX *)(PnpDeviceEventList + 64));
  if( PoolWithTag )
  {
    PoolWithTag->WorkerRoutine = (void(__fastcall *)(void *))PnpDeviceEventWorker;
    PoolWithTag->Parameter = PoolWithTag;
    PoolWithTag->List.Flink = 0i64;
    ExQueueWorkItem(PoolWithTag, DelayedWorkQueue);
  }
  return v2;
}

Referenced by: