IoReportTargetDeviceChange

NTSTATUS __stdcall IoReportTargetDeviceChange(_DEVICE_OBJECT *PhysicalDeviceObject, VOID *NotificationStructure){
  _DWORD *DeviceNode; 
  GUID *v5; 
  int v6; 
  int v7; 
  NTSTATUS result; 
  _DRIVER_OBJECT *DriverObject; 
  _UNICODE_STRING *p_DriverName; 
  VOID **v11; 
  VOID **v12; 
  _DEVOBJ_EXTENSION *DeviceObjectExtension; 
  _WORD *v14; 
  __int64 v15; 
  _WORD *v16; 
  __int64 v17; 
  __int128 Object; 
  __int64 v19; 
  NTSTATUS v20; 

  v19 = 0i64;
  v20 = 0;
  Object = 0i64;
  if( !PhysicalDeviceObject )
    goto LABEL_29;
  DeviceNode = PhysicalDeviceObject->DeviceObjectExtension->DeviceNode;
  if( !DeviceNode || (DeviceNode[99] & 0x20000) != 0 )
  {
    IoAddTriageDumpDataBlock(PhysicalDeviceObject, (_BYTE *)PhysicalDeviceObject->Size);
    DriverObject = PhysicalDeviceObject->DriverObject;
    if( DriverObject )
    {
      IoAddTriageDumpDataBlock(DriverObject, (_BYTE *)(unsigned int)DriverObject->Size);
      p_DriverName = &PhysicalDeviceObject->DriverObject->DriverName;
      if( p_DriverName->Length )
      {
        IoAddTriageDumpDataBlock(p_DriverName, (_BYTE *)2);
        IoAddTriageDumpDataBlock(
          PhysicalDeviceObject->DriverObject->DriverName.Buffer,
          (_BYTE *)PhysicalDeviceObject->DriverObject->DriverName.Length);
      }
    }
    v11 = (VOID **)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode;
    if( v11 )
    {
      v12 = v11 + 5;
      IoAddTriageDumpDataBlock(v11, (_BYTE *)0x310);
      if( *(_WORD *)v12 )
      {
        IoAddTriageDumpDataBlock(v12, (_BYTE *)2);
        IoAddTriageDumpDataBlock(v12[1], (_BYTE *)*(unsigned __int16 *)v12);
      }
      DeviceObjectExtension = PhysicalDeviceObject->DeviceObjectExtension;
      v14 = (char *)DeviceObjectExtension->DeviceNode + 56;
      if( *v14 )
      {
        IoAddTriageDumpDataBlock(v14, (_BYTE *)2);
        IoAddTriageDumpDataBlock(
          *((VOID **)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 8),
          (_BYTE *)*((unsigned __int16 *)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 28));
        DeviceObjectExtension = PhysicalDeviceObject->DeviceObjectExtension;
      }
      v15 = *((_QWORD *)DeviceObjectExtension->DeviceNode + 2);
      if( v15 )
      {
        v16 = (_WORD *)(v15 + 56);
        if( *v16 )
        {
          IoAddTriageDumpDataBlock(v16, (_BYTE *)2);
          v17 = *((_QWORD *)PhysicalDeviceObject->DeviceObjectExtension->DeviceNode + 2);
          IoAddTriageDumpDataBlock(*(VOID **)(v17 + 64), (_BYTE *)*(unsigned __int16 *)(v17 + 56));
        }
      }
    }
LABEL_29:
    KeBugCheckEx(0xCAu, (PVOID)2, PhysicalDeviceObject, 0i64, 0i64);
  }
  v5 = (GUID *)((char *)NotificationStructure + 4);
  if( (char *)NotificationStructure + 4 == (char *)&GUID_TARGET_DEVICE_QUERY_REMOVE )
    return -1073741808;
  if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_QUERY_REMOVE, 16) == (_SIZE_T *)16 )
    return -1073741808;
  if( v5 == &GUID_TARGET_DEVICE_REMOVE_CANCELLED )
    return -1073741808;
  if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_REMOVE_CANCELLED, 16) == (_SIZE_T *)16 )
    return -1073741808;
  if( v5 == &GUID_TARGET_DEVICE_REMOVE_COMPLETE )
    return -1073741808;
  if( RtlCompareMemory(v5, &GUID_TARGET_DEVICE_REMOVE_COMPLETE, 16) == (_SIZE_T *)16 )
    return -1073741808;
  v6 = *((unsigned __int16 *)NotificationStructure + 1);
  if( (unsigned __int16)v6 < 0x24u )
    return -1073741808;
  v7 = *((_DWORD *)NotificationStructure + 8);
  if( v7 != -1 && v7 > v6 - 36 )
    return -1073741808;
  KeInitializeEvent((INT64)&Object, 0, 0);
  result = PnpSetCustomTargetEvent(PhysicalDeviceObject, (__int64)&Object, &v20, 0i64, 0i64, NotificationStructure);
  if( result >= 0 )
  {
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    return v20;
  }
  return result;
}

Referenced by:

FsRtlNotifyVolumeEventEx
NtSetVolumeInformationFile