PsCallImageNotifyRoutines

VOID __stdcall PsCallImageNotifyRoutines(
        _UNICODE_STRING *FullImageName,
        VOID *ProcessId,
        _IMAGE_INFO_EX *ExtendedInfo,
        _FILE_OBJECT *FileObject){
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  __int64 v10; 
  IMAGE_INFO *p_ImageInfo; 
  INT64 *v12; 
  _EX_RUNDOWN_REF *v13; 
  _EX_RUNDOWN_REF *v14; 
  void(__fastcall *Count)(_UNICODE_STRING *, __int64, IMAGE_INFO *); 
  __int128 v16; 
  __int64 v17; 

  v16 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v9 = 0i64;
  v17 = 0i64;
  if( KeAreAllApcsDisabled() )
    __int2c();
  if( *(&stru_140CF2E80 + 599)
    && (*(int(__fastcall **)(_FILE_OBJECT *, __int64, __int128 *, __int64 *))(*(&stru_140CF2E80 + 599) + 24i64))(
         FileObject,
         1024i64,
         &v16,
         &v17) >= 0 )
  {
    FullImageName = (_UNICODE_STRING *)&v16;
  }
  if( ProcessId )
    v9 = *((_QWORD *)ProcessId + 136);
  if( (PspNotifyEnableMask & 1) != 0 )
  {
    ExtendedInfo->ImageInfo.anonymous_0.Properties |= 0x400u;
    v10 = 64i64;
    p_ImageInfo = &ExtendedInfo->ImageInfo;
    *(_QWORD *)&ExtendedInfo->Size = 56i64;
    *(_QWORD *)&ExtendedInfo[1].Size = FileObject;
    v12 = (INT64 *)&CallBack;
    do
    {
      v13 = ExReferenceCallBackBlock(v12);
      v14 = v13;
      if( v13 )
      {
        Count = (void(__fastcall *)(_UNICODE_STRING *, __int64, IMAGE_INFO *))v13[1].Count;
        if( ((p_ImageInfo->anonymous_0.Properties & 0x800) == 0 || (v14[2].Count & 1) != 0) && Count )
          Count(FullImageName, v9, p_ImageInfo);
        ExDereferenceCallBackBlock((_EX_CALLBACK *)v12, v14);
      }
      ++v12;
      --v10;
    }
    while( v10 );
  }
  if( v17 )
    (*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}

Referenced by: