PiAuditDeviceStart

VOID __stdcall PiAuditDeviceStart(_UNICODE_STRING *DeviceInstance){
  wchar_t *Buffer; 
  char v3; 
  int v4; 
  int v5; 

  Buffer = DeviceInstance->Buffer;
  v4 = 0;
  v3 = 0;
  v5 = 1;
  if( PnpGetObjectProperty(
         *(&stru_140CF2E80 + 1214),
         (INT64)Buffer,
         1i64,
         0i64,
         0i64,
         (INT64)&DEVPKEY_Device_InLocalMachineContainer,
         (INT64)&v4,
         (INT64)&v3) >= 0
    && v4 == 17
    && v5 == 1
    && v3 != -1 )
  {
    PiAuditDeviceOperation(DeviceInstance, PNP_AUDIT_OPERATION_REMOVABLE_START, 1u);
  }
}

Referenced by: