PnpMarkDeviceForRemove

ULONG_PTR __fastcall PnpMarkDeviceForRemove(ULONG_PTR a1, int a2, ULONG_PTR *a3){
  ULONG_PTR v5; 
  KIRQL v6; 
  ULONG_PTR result; 
  UINT8 v8; 
  __int64 v9; 
  KIRQL v10; 
  __int16 v11; 
  __int16 v12; 
  void *v13; 
  v5 = a1;
  if( a2 )
  {
    a3[1] = 0i64;
    *a3 = a1;
  }
  if( a1 )
  {
    do
    {
      if( *(_QWORD *)(v5 + 56) )
      {
        v8 = KeAcquireQueuedSpinLock(9ui64);
        v9 = *(_QWORD *)(v5 + 56);
        v10 = v8;
        v11 = *(_WORD *)(v9 + 4);
        if( a2 )
        {
          v12 = v11 | 8;
          *(_WORD *)(v9 + 4) = v12;
          if( (v12 & 1) != 0 )
          {
            v13 = *(void **)(v9 + 8);
            a3[1] = (ULONG_PTR)v13;
            *a3 = v5;
            ObfReferenceObjectWithTag(v13, 0x746C6644u);
            IopIncrementDeviceObjectRefCount((_DEVICE_OBJECT *)a3[1], 1u);
          }
        }
        else
        {
          *(_WORD *)(v9 + 4) = v11 & 0xFFF7;
        }
        KeReleaseQueuedSpinLock(9ui64, v10);
      }
      if( a2 && a3[1] )
        break;
      v6 = KeAcquireQueuedSpinLock(0xAui64);
      v5 = *(_QWORD *)(v5 + 24);
      KeReleaseQueuedSpinLock(0xAui64, v6);
    }
    while( v5 );
  }
  result = a3[1];
  if( !result )
    return *a3;
  return result;
}

Referenced by:

IopRemoveDevice
PiIrpQueryRemoveDevice
PnpSurpriseRemoveLockedDeviceNode