PspCallProcessNotifyRoutines

NTSTATUS __stdcall PspCallProcessNotifyRoutines(
        _EX_RUNDOWN_REF *Process,
        PSP_CREATE_PROCESS_CONTEXT *CreateContext,
        UINT8 Create){
  void(__fastcall **ExtensionTable)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *); 
  void(__fastcall **v7)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *); 
  unsigned __int64 Count; 
  NTSTATUS v9; 
  unsigned int v10; 
  int v11; 
  __int128 v12; 
  char *v13; 
  PSP_CREATE_PROCESS_CONTEXT *v14; 
  __int64 v15; 
  __int64 v16; 
  __int128 *v17; 
  unsigned int v18; 
  _EX_RUNDOWN_REF *v19; 
  __int64 v20; 
  _EX_RUNDOWN_REF *v21; 
  int v23; 
  int v24; 
  _QWORD *v25; 
  void(__fastcall **v26)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *); 
  unsigned __int64 v27; 
  void(__fastcall **v28)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *); 
  __int128 v29[8]; 
  char v30; 
  VOID *OutFileObject; 

  memset(v29, 0i64, 0x48u);
  ExtensionTable = (void(__fastcall **)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *))ExGetExtensionTable((_EX_HOST *)PspDamExtensionHost);
  v26 = ExtensionTable;
  v7 = (void(__fastcall **)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *))ExGetExtensionTable((_EX_HOST *)PspBamExtensionHost);
  Count = Process[280].Count;
  v9 = 0;
  v10 = ((unsigned int)PspNotifyEnableMask >> 2) & 1;
  v28 = v7;
  OutFileObject = 0i64;
  v30 = 0;
  v27 = Count;
  if( !Create || (PspNotifyEnableMask & 4) == 0 && !ExtensionTable && !v7 )
  {
    v17 = 0i64;
    goto LABEL_17;
  }
  v11 = 0;
  *(_QWORD *)&v29[0] = 72i64;
  if( Count )
    v11 = 2;
  DWORD2(v29[0]) = v11;
  *(_EX_RUNDOWN_REF *)&v29[1] = Process[168];
  v12 = *(_OWORD *)&KeGetCurrentThread()[1].CycleTime;
  LODWORD(v29[4]) = 0;
  *(__int128 *)((char *)&v29[1] + 8) = v12;
  if( Count )
  {
    *((_QWORD *)&v29[2] + 1) = 0i64;
    v29[3] = 0i64;
    if( !CreateContext )
      goto LABEL_16;
    v25 = (_QWORD *)*((_QWORD *)CreateContext + 57);
    if( !v25 )
      goto LABEL_16;
    *((_QWORD *)&v29[2] + 1) = *v25;
    *(_QWORD *)&v29[3] = v25[1];
    v16 = v25[2];
  }
  else
  {
    if( CreateContext && (v13 = (char *)*((_QWORD *)CreateContext + 22)) != 0i64 )
    {
      OutFileObject = (VOID *)*((_QWORD *)CreateContext + 22);
    }
    else
    {
      v30 = 1;
      PsReferenceProcessFilePointer((_EPROCESS *)Process, &OutFileObject);
      v13 = (char *)OutFileObject;
    }
    *((_QWORD *)&v29[2] + 1) = v13;
    if( CreateContext && (CreateContext[1] & 0x20) != 0 )
    {
      DWORD2(v29[0]) |= 1u;
      v14 = CreateContext + 58;
    }
    else
    {
      v14 = (PSP_CREATE_PROCESS_CONTEXT *)(v13 + 88);
    }
    *(_QWORD *)&v29[3] = v14;
    if( !CreateContext || (v15 = *((_QWORD *)CreateContext + 26)) == 0 )
    {
      *((_QWORD *)&v29[3] + 1) = 0i64;
      goto LABEL_16;
    }
    v16 = v15 + 112;
  }
  *((_QWORD *)&v29[3] + 1) = v16;
LABEL_16:
  v17 = v29;
LABEL_17:
  if( (PspNotifyEnableMask & 2) != 0 || (_BYTE)v10 )
  {
    v18 = 0;
    while( 1 )
    {
      v19 = ExReferenceCallBackBlock((INT64 *)&stru_140CEC120.Ptr + v18);
      v21 = v19;
      if( v19 )
      {
        v23 = v19[2].Count;
        if( !v27 || (v23 & 4) != 0 )
        {
          if( (v23 & 2) != 0 )
          {
            if( (_BYTE)v10 )
              ((void(__fastcall *)(_EX_RUNDOWN_REF *, unsigned __int64, __int128 *))v21[1].Count)(
                Process,
                Process[136].Count,
                v17);
          }
          else
          {
            LOBYTE(v20) = Create;
            ((void(__fastcall *)(unsigned __int64, unsigned __int64, __int64))v21[1].Count)(
              Process[168].Count,
              Process[136].Count,
              v20);
          }
        }
        ExDereferenceCallBackBlock((_EX_CALLBACK *)&stru_140CEC120.Ptr + 2 * v18, v21);
        if( v17 )
        {
          v24 = *((_DWORD *)v17 + 16);
          if( v24 < 0 )
            break;
        }
      }
      if( ++v18 >= 0x40 )
        goto LABEL_21;
    }
    v9 = *((_DWORD *)v17 + 16);
    PsTerminateProcess((ULONG_PTR)Process, (unsigned int)v24);
LABEL_21:
    ExtensionTable = v26;
  }
  if( v28 && (!v17 || *((int *)v17 + 16) >= 0) )
  {
    (*v28)(Process, Process[136].Count, v17);
    ExReleaseExtensionTable(PspBamExtensionHost);
  }
  if( ExtensionTable && (!v17 || *((int *)v17 + 16) >= 0) )
  {
    (*ExtensionTable)(Process, Process[136].Count, v17);
    ExReleaseExtensionTable(PspDamExtensionHost);
  }
  if( v30 )
    HalPutDmaAdapter((PADAPTER_OBJECT)OutFileObject);
  return v9;
}

Referenced by: