PnpMarkDeviceForRemove
ULONG_PTR __fastcall PnpMarkDeviceForRemove(ULONG_PTR a1, int a2, ULONG_PTR *a3){
ULONG_PTR v5;
KIRQL v6;
ULONG_PTR result;
UINT8 v8;
__int64 v9;
KIRQL v10;
__int16 v11;
__int16 v12;
void *v13;
v5 = a1;
if( a2 )
{
a3[1] = 0i64;
*a3 = a1;
}
if( a1 )
{
do
{
if( *(_QWORD *)(v5 + 56) )
{
v8 = KeAcquireQueuedSpinLock(9ui64);
v9 = *(_QWORD *)(v5 + 56);
v10 = v8;
v11 = *(_WORD *)(v9 + 4);
if( a2 )
{
v12 = v11 | 8;
*(_WORD *)(v9 + 4) = v12;
if( (v12 & 1) != 0 )
{
v13 = *(void **)(v9 + 8);
a3[1] = (ULONG_PTR)v13;
*a3 = v5;
ObfReferenceObjectWithTag(v13, 0x746C6644u);
IopIncrementDeviceObjectRefCount((_DEVICE_OBJECT *)a3[1], 1u);
}
}
else
{
*(_WORD *)(v9 + 4) = v11 & 0xFFF7;
}
KeReleaseQueuedSpinLock(9ui64, v10);
}
if( a2 && a3[1] )
break;
v6 = KeAcquireQueuedSpinLock(0xAui64);
v5 = *(_QWORD *)(v5 + 24);
KeReleaseQueuedSpinLock(0xAui64, v6);
}
while( v5 );
}
result = a3[1];
if( !result )
return *a3;
return result;
}Referenced by:
IopRemoveDevice
PiIrpQueryRemoveDevice
PnpSurpriseRemoveLockedDeviceNode