PopFlushVolumeWorker

VOID __stdcall PopFlushVolumeWorker(POP_FLUSH_VOLUME *Flush){
  _QWORD *v2; 
  __int64 v3; 
  _QWORD *v4; 
  _QWORD *v5; 
  UINT64 FileAttributes; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  VOID *FileHandle; 
  UINT64 ReturnLength; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG Length[128]; 

  LODWORD(ReturnLength) = 0;
  FileHandle = 0i64;
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset(Length, 0i64, sizeof(Length));
  ExAcquireFastMutex((PFAST_MUTEX)((char *)&stru_140C23628 + 1368));
  while( 1 )
  {
    v2 = *(_QWORD **)Flush->List;
    if( *(POP_FLUSH_VOLUME **)Flush->List == Flush )
      break;
    v3 = *v2;
    if( *(_QWORD **)(*v2 + 8i64) != v2
      || (v4 = (_QWORD *)v2[1], (_QWORD *)*v4 != v2)
      || (*v4 = v3,
          *(_QWORD *)(v3 + 8) = v4,
          v5 = (_QWORD *)*(&stru_140C23628 + 168),
          (_UNKNOWN *)**(&stru_140C23628 + 168) != (_UNKNOWN *)((char *)&stru_140C23628 + 1336)) )
    {
      __fastfail(3u);
    }
    *v2 = (char *)&stru_140C23628 + 1336;
    v2[1] = v5;
    *v5 = v2;
    *(&stru_140C23628 + 168) = v2;
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C23628 + 1368));
    if( ObQueryNameString((VOID *)*(v2 - 6), (_OBJECT_NAME_INFORMATION *)Length, 0x200ui64, &ReturnLength) >= 0 )
    {
      if( *(_QWORD *)&Length[2] )
      {
        LODWORD(EaLength) = 0;
        LODWORD(CreateOptions) = 32;
        LODWORD(CreateDisposition) = 1;
        LODWORD(ShareAccess) = 3;
        LODWORD(FileAttributes) = -1073741824;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.Attributes = 576;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)Length;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( ZwCreateFile(
               &FileHandle,
               0x100003ui64,
               &ObjectAttributes,
               &IoStatusBlock,
               0i64,
               FileAttributes,
               ShareAccess,
               CreateDisposition,
               CreateOptions,
               0i64,
               EaLength) >= 0 )
        {
          if( Flush[1].Wait[4] )
          {
            PopFlushAndHold(FileHandle, &IoStatusBlock);
          }
          else if( Flush[1].Wait[5] )
          {
            NtDeviceIoControlFile((_HANDLE)FileHandle, 0, 0i64, 0i64, &IoStatusBlock, 0x53C004u, 0i64, 0, 0i64, 0);
          }
          else
          {
            ZwFlushBuffersFile(FileHandle, &IoStatusBlock);
          }
          ZwClose((_HANDLE)FileHandle);
        }
      }
    }
    ExAcquireFastMutex((PFAST_MUTEX)((char *)&stru_140C23628 + 1368));
  }
  if( (*(_DWORD *)&Flush->Wait[4])-- == 1 )
    KeSetEvent((PRKEVENT)&Flush->Wait[12], 0, 0);
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C23628 + 1368));
}

Referenced by: