PiUEventNotifyTargetDeviceChange

__int64 __fastcall PiUEventNotifyTargetDeviceChange(__int64 a1){
  _DWORD *v1; 
  char v2; 
  int v3; 
  unsigned int v4; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  int v11; 
  __int64 v12; 
  const WCHAR *v13; 
  unsigned int v14; 
  _QWORD **v15; 
  _QWORD *v16; 
  char v17; 
  __int64 v18; 
  __int64 v20; 
  VOID **PoolWithTag; 
  UINT64 v22; 
  UINT64 MatchingChangeStamp; 
  UINT64 CheckStamp; 
  char v25; 
  char v26; 

  v1 = 0i64;
  v2 = 0;
  v25 = 0;
  v3 = 0;
  v26 = 0;
  v4 = 0;
  v6 = *(_QWORD *)(a1 + 72) - *(_QWORD *)&GUID_TARGET_DEVICE_QUERY_REMOVE.Data1;
  if( !v6 )
    v6 = *(_QWORD *)(a1 + 80) - *(_QWORD *)GUID_TARGET_DEVICE_QUERY_REMOVE.Data4;
  if( !v6 )
    goto LABEL_16;
  v7 = *(_QWORD *)(a1 + 72) - *(_QWORD *)&GUID_TARGET_DEVICE_REMOVE_CANCELLED.Data1;
  if( !v7 )
    v7 = *(_QWORD *)(a1 + 80) - *(_QWORD *)GUID_TARGET_DEVICE_REMOVE_CANCELLED.Data4;
  if( !v7 )
    goto LABEL_16;
  v8 = *(_QWORD *)(a1 + 72) - *(_QWORD *)&GUID_DEVICE_REMOVE_PENDING.Data1;
  if( !v8 )
    v8 = *(_QWORD *)(a1 + 80) - *(_QWORD *)GUID_DEVICE_REMOVE_PENDING.Data4;
  if( !v8 )
    goto LABEL_16;
  v9 = *(_QWORD *)(a1 + 72) - *(_QWORD *)&GUID_TARGET_DEVICE_REMOVE_COMPLETE.Data1;
  if( !v9 )
    v9 = *(_QWORD *)(a1 + 80) - *(_QWORD *)GUID_TARGET_DEVICE_REMOVE_COMPLETE.Data4;
  if( !v9 )
    goto LABEL_16;
  v10 = *(_QWORD *)(a1 + 72) - *(_QWORD *)&GUID_PNP_CUSTOM_NOTIFICATION.Data1;
  if( !v10 )
    v10 = *(_QWORD *)(a1 + 80) - *(_QWORD *)GUID_PNP_CUSTOM_NOTIFICATION.Data4;
  if( !v10 )
  {
LABEL_16:
    v11 = *(_DWORD *)(a1 + 88) - 1;
    if( v11 )
    {
      if( v11 != 2 )
        return(unsigned int)v3;
      v25 = 1;
      v12 = 128i64;
    }
    else
    {
      v12 = 120i64;
    }
    v13 = (const WCHAR *)(v12 + a1);
    if( *(_BYTE *)(a1 + 68) )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 1500540496i64);
      v1 = PoolWithTag;
      if( !PoolWithTag )
        return(unsigned int)-1073741670;
      memset(PoolWithTag, 0i64, 0x1000u);
      v4 = 1;
    }
    ExAcquireFastMutex((PFAST_MUTEX)((char *)&PnpReplaceEvent + 7040));
    PiUEventHashStringIntoBucket(v13);
    v15 = (_QWORD **)((char *)&PnpReplaceEvent + 16 * v14 + 7328);
    v16 = *v15;
    if( *v15 != v15 )
    {
      v17 = v25;
      do
      {
        v18 = (__int64)v16;
        v16 = (_QWORD *)*v16;
        if( !v17 || !*(_BYTE *)(v18 + 40) )
        {
          if( wcsicmp(v13, *(const wchar_t **)(*(_QWORD *)(v18 + 24) + 16i64))
            || !PiUEventApplyAdditionalFilters(a1, v18)
            || (v3 = PiUEventNotifyClient(a1, v18), v3 < 0) )
          {
            v17 = v25;
          }
          else
          {
            v17 = v25;
            if( v1 )
            {
              if( v4 >= 0x400 )
              {
                v2 = 1;
                v26 = 1;
                continue;
              }
              v20 = v4++;
              v1[v20] = *(_DWORD *)(v18 + 48);
            }
          }
        }
        v2 = v26;
      }
      while( v16 != v15 );
    }
    if( v1 && v4 > 1 )
    {
      if( v2 )
      {
        memset(v1 + 1, 0i64, 0xFFCu);
        *v1 = -1;
        v22 = 4i64;
      }
      else
      {
        v22 = 4096i64;
        *v1 = v4 - 1;
      }
      LODWORD(CheckStamp) = 0;
      LODWORD(MatchingChangeStamp) = 0;
      ZwUpdateWnfStateData(&WNF_PNPB_AWAITING_RESPONSE, v1, v22, 0i64, 0i64, MatchingChangeStamp, CheckStamp);
    }
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&PnpReplaceEvent + 7040));
    if( v1 )
      ExFreePoolWithTag(v1, 0x59706E50u);
  }
  return(unsigned int)v3;
}

Referenced by: