PiCheckRemovalPreconditions

INT64 __fastcall PiCheckRemovalPreconditions(INT64 a1, INT64 a2){
  INT64 TargetDeviceNode; 
  _PNP_DEVICE_EVENT_ENTRY *v3; 
  __int64 v4; 
  int v5; 
  INT64 v6; 
  INT64 result; 
  _UNICODE_STRING *v8; 
  _PNP_VETO_TYPE v9; 
  TargetDeviceNode = PiGetTargetDeviceNode(a2);
  v6 = TargetDeviceNode;
  if( (v5 & 0xFFFFFFFB) == 0 && (*(_DWORD *)(TargetDeviceNode + 396) & 0x1000) != 0 )
  {
    v8 = (_UNICODE_STRING *)(TargetDeviceNode + 40);
    v9 = PNP_VetoLegacyDevice;
LABEL_14:
    PnpFinalizeVetoedRemove(v3, v9, v8);
    return 2147483688i64;
  }
  result = 0i64;
  if( !v5 && *(_DWORD *)(v4 + 16) == 22 && *(_DWORD *)(v6 + 600) )
  {
    v8 = (_UNICODE_STRING *)(v6 + 40);
    v9 = PNP_VetoNonDisableable;
    goto LABEL_14;
  }
  if( *(_DWORD *)(v6 + 300) == 786 && !v5 && *(_DWORD *)(v4 + 16) == 54 )
  {
    v8 = 0i64;
    v9 = PNP_VetoAlreadyRemoved;
    goto LABEL_14;
  }
  return result;
}

Referenced by: