IoRegisterContainerNotification

NTSTATUS __fastcall IoRegisterContainerNotification(
        INT64 a1,
        INT64 a2,
        INT64 a3,
        INT64 a4,
        INT64 **CallbackRegistration){
  int v5; 
  INT64 v7; 
  _ETHREAD *CurrentThread; 
  _DEVICE_OBJECT *v10; 
  void **v11; 
  void **v12; 
  VOID **PoolWithTag; 
  VOID **v14; 
  VOID *v15; 
  VOID *SessionObjectById; 
  void *DriverObject; 
  _DEVICE_OBJECT *DevicePDO; 
  _ADAPTER_OBJECT *v19; 
  unsigned int SessionIdFromPDO; 
  VOID ***v21; 

  v5 = 0;
  v7 = a2;
  if( (int)a1 >= 1 )
    return -1073741585;
  if( (_DWORD)a4 == 32 && *(_DWORD *)a3 == 32 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v10 = *(_DEVICE_OBJECT **)(a3 + 8);
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C452E0 + 119, 0i64);
    v11 = (void **)*(&stru_140C452E0 + 120);
    while( v11 != (void **)((char *)&stru_140C452E0 + 960) )
    {
      v12 = v11;
      v11 = (void **)*v11;
      if( v12[5] == v10 )
      {
        v5 = -1073741791;
        goto LABEL_30;
      }
    }
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x48ui64, 1850961737i64);
    v14 = PoolWithTag;
    if( !PoolWithTag )
    {
      v5 = -1073741670;
      goto LABEL_30;
    }
    v15 = ExRegisterCallback(*(&stru_140C452E0 + 102), IopDispatchSessionNotifications, PoolWithTag);
    if( !v15 )
    {
      v5 = -1073741670;
      goto LABEL_28;
    }
    SessionObjectById = 0i64;
    switch( v10->Type )
    {
      case 3:
        DriverObject = v10->DriverObject;
        if( (v10->DeviceObjectExtension->ExtensionFlags & 0x400) != 0 )
        {
          DevicePDO = IopGetDevicePDO(v10);
          v19 = (_ADAPTER_OBJECT *)DevicePDO;
          if( DevicePDO )
          {
            SessionIdFromPDO = IopGetSessionIdFromPDO(DevicePDO);
            SessionObjectById = MmGetSessionObjectById(SessionIdFromPDO);
            HalPutDmaAdapter(v19);
          }
          v7 = a2;
        }
        v10->DeviceObjectExtension->ExtensionFlags |= 0x1000u;
        break;
      case 4:
        DriverObject = v10;
        break;
      case 5:
        DriverObject = v10->DriverObject->DeviceObject;
        v5 = IopSetFileObjectExtensionFlag((_FILE_OBJECT *)v10, 2ui64, 1u);
        if( v5 < 0 )
        {
LABEL_28:
          ExFreePoolWithTag(v14, 0);
          if( v15 )
            ExUnregisterCallback(v15);
LABEL_30:
          ExReleasePushLockEx((ULONG_PTR)&stru_140C452E0 + 952, 0);
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          return v5;
        }
        break;
      default:
        v5 = -1073741583;
        goto LABEL_28;
    }
    ObfReferenceObject(DriverObject);
    v14[5] = v10;
    v14[2] = DriverObject;
    v14[4] = v15;
    v14[8] = *(VOID **)(a3 + 24);
    *((_DWORD *)v14 + 14) = *(_DWORD *)(a3 + 16);
    v14[3] = (VOID *)v7;
    v14[6] = SessionObjectById;
    *CallbackRegistration = (INT64 *)v15;
    v21 = (VOID ***)*(&stru_140C452E0 + 121);
    if( (_UNKNOWN *)**(&stru_140C452E0 + 121) != (_UNKNOWN *)((char *)&stru_140C452E0 + 960) )
      __fastfail(3u);
    *v14 = (char *)&stru_140C452E0 + 960;
    v14[1] = v21;
    *v21 = v14;
    *(&stru_140C452E0 + 121) = v14;
    goto LABEL_30;
  }
  return -1073741582;
}

Referenced by: