IoRegisterFsRegistrationChangeMountAware

NTSTATUS __stdcall IoRegisterFsRegistrationChangeMountAware(
        PDRIVER_OBJECT DriverObject,
        PDRIVER_FS_NOTIFICATION DriverNotificationRoutine,
        BOOL SynchronizeWithMounts){
  NTSTATUS result; 
  INT64 v7; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v9; 
  VOID **PoolWithTag; 
  VOID ***v11; 
  char v12; 
  REGHANDLE v13; 
  int Length; 
  _LPCGUID ActivityIdThread; 
  INT64 v16; 
  __int16 v17; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  wchar_t *Buffer; 
  int v20; 
  int v21; 

  if( *(&stru_140CF2E80 + 1659) )
  {
    IopIsKnownGoodLegacyFsFilter(&DriverObject->DriverName, DriverNotificationRoutine);
    if( !v12 )
    {
      v13 = *(&stru_140C452E0 + 327);
      if( EtwEventEnabled(*(&stru_140C452E0 + 327), &IoMgr_LegacyFsFilterBlockedByPolicy) )
      {
        Length = DriverObject->DriverName.Length;
        UserData.Reserved = 0;
        v21 = 0;
        v17 = (unsigned __int16)Length >> 1;
        UserData.Ptr = (unsigned __int64)&v17;
        Buffer = DriverObject->DriverName.Buffer;
        UserData.Size = 2;
        v20 = Length;
        ActivityIdThread = (unsigned int)IoGetActivityIdThread();
        EtwWrite(v13, &IoMgr_LegacyFsFilterBlockedByPolicy, ActivityIdThread, 2u, &UserData);
      }
      return -1073741637;
    }
  }
  result = FsRtlSetDriverBacking(DriverObject, 1ui64);
  if( result < 0 )
    return result;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  if( !SynchronizeWithMounts )
  {
LABEL_22:
    ExAcquireResourceExclusiveLite((UINT64)&stru_140C452E0 + 1280, 1, v7);
    goto LABEL_5;
  }
  if( !ExAcquireResourceExclusiveLite((UINT64)&stru_140C452E0 + 1280, 0, v7) )
  {
    if( IopGetFsRegistrationInProgress() )
    {
      v9 = -1073741267;
      goto LABEL_9;
    }
    goto LABEL_22;
  }
LABEL_5:
  if( (_UNKNOWN *)*(&stru_140C452E0 + 208) != (_UNKNOWN *)((char *)&stru_140C452E0 + 1664)
    && *(PDRIVER_OBJECT *)(*(&stru_140C452E0 + 209) + 16i64) == DriverObject
    && *(PDRIVER_FS_NOTIFICATION *)(*(&stru_140C452E0 + 209) + 24i64) == DriverNotificationRoutine )
  {
    ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1280));
    v9 = -1073741768;
LABEL_9:
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return v9;
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x20ui64, 1933995849i64);
  if( !PoolWithTag )
  {
    ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1280));
    v9 = -1073741670;
    goto LABEL_9;
  }
  PoolWithTag[2] = DriverObject;
  PoolWithTag[3] = DriverNotificationRoutine;
  v11 = (VOID ***)*(&stru_140C452E0 + 209);
  if( (_UNKNOWN *)**(&stru_140C452E0 + 209) != (_UNKNOWN *)((char *)&stru_140C452E0 + 1664) )
    __fastfail(3u);
  *PoolWithTag = (char *)&stru_140C452E0 + 1664;
  PoolWithTag[1] = v11;
  *v11 = PoolWithTag;
  *(&stru_140C452E0 + 209) = PoolWithTag;
  if( SynchronizeWithMounts )
  {
    while( *(&WheapErrorSourceTable + 220) )
    {
      ++*(&stru_140CF2E80 + 1629);
      ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1280));
      KeWaitForSingleObject((UINT64)&stru_140C452E0 + 2496, 0, 0, 0, 0i64);
      ExAcquireResourceExclusiveLite((UINT64)&stru_140C452E0 + 1280, 1, v16);
      if( --*(&stru_140CF2E80 + 1629) )
      {
        if( !*(&WheapErrorSourceTable + 220) )
          break;
      }
      KeResetEvent((_KEVENT *)((char *)&stru_140C452E0 + 2496));
    }
  }
  IopNotifyAlreadyRegisteredFileSystems((PLIST_ENTRY)&stru_140C452E0 + 96, DriverNotificationRoutine, 0);
  IopNotifyAlreadyRegisteredFileSystems((PLIST_ENTRY)&stru_140C452E0 + 98, DriverNotificationRoutine, 1u);
  IopNotifyAlreadyRegisteredFileSystems((PLIST_ENTRY)&stru_140C452E0 + 97, DriverNotificationRoutine, 1u);
  IopNotifyAlreadyRegisteredFileSystems((PLIST_ENTRY)&stru_140C452E0 + 95, DriverNotificationRoutine, 1u);
  ExReleaseResourceLite((PERESOURCE)((char *)&stru_140C452E0 + 1280));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  ObfReferenceObject(DriverObject);
  return 0;
}

Referenced by: