PipClearDevNodeProblem

INT64 __fastcall PipClearDevNodeProblem(INT64 a1, const WCHAR *a2, INT64 a3){
  INT64 result; 
  unsigned int v5; 
  unsigned int v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  GUID *v10; 
  void *retaddr; 
  PVOID P; 
  result = (INT64)&retaddr;
  P = 0i64;
  v5 = *(_DWORD *)(a1 + 404);
  v6 = *(_DWORD *)(a1 + 408);
  if( (*(_DWORD *)(a1 + 396) & 0x2000) != 0 || v5 )
  {
    PiPnpRtlBeginOperation((__int64 **)&P);
    PipClearDevNodeFlags((_DEVICE_NODE *)a1, 0x2000ui64);
    v8 = *(_QWORD *)(a1 + 48);
    *(_DWORD *)(a1 + 404) = 0;
    *(_DWORD *)(a1 + 408) = 0;
    if( v8 )
    {
      PnpRaiseNtPlugPlayDevicePropertyChangeEvent(v7, v8, 12);
      if( *(_DWORD *)(a1 + 408) != v6 )
        PnpRaiseNtPlugPlayDevicePropertyChangeEvent(v9, *(_QWORD *)(a1 + 48), 13);
      PnpTraceClearDevNodeProblem((UNICODE_STRING *)(a1 + 40), (UNICODE_STRING *)(a1 + 56), v5, v6, v10);
      if( v5 == 22 )
      {
        result = SeAuditingWithTokenForSubcategory(0x89ui64, 0i64);
        if( (_BYTE)result )
          PiAuditDeviceEnableDisableAction((UNICODE_STRING *)(a1 + 40), 0x16ui64, *(unsigned int *)(a1 + 404));
      }
    }
    if( P )
      PiPnpRtlEndOperation(P);
  }
  return result;
}

Referenced by: