PopInvokeWin32Callout

NTSTATUS __fastcall PopInvokeWin32Callout(INT64 a1, VOID *a2, INT64 a3, UINT64 *a4){
  PS_WIN32_SESSION_ATTACH_MODE v4; 
  char v6; 
  NTSTATUS v7; 
  PKINTERRUPT_ROUTINE **v8; 
  _MM_SESSION_SPACE *Session; 
  _EPROCESS *NextSession; 
  PKINTERRUPT_ROUTINE *v11; 
  __int64 v12; 
  PS_WIN32_SESSION_ATTACH_MODE v13; 
  UINT64 *p_SessionId; 
  UINT64 v16; 
  UINT64 v17; 
  int v18; 
  NTSTATUS SessionId; 
  __int64 OutputBuffer; 
  __int64 InputBuffer[18]; 
  _WIN32_CALLOUTS_OPERATION Operation; 

  Operation = (int)a1;
  v4 = (int)a3;
  SessionId = 0;
  v18 = 0;
  OutputBuffer = 0i64;
  v6 = 0;
  v7 = 0;
  memset((char *)InputBuffer + 4, 0i64, 0x5Cu);
  LODWORD(InputBuffer[0]) = 21;
  LODWORD(v16) = 8;
  if( ZwPowerInformation(PowerInformationInternal, InputBuffer, 0x60ui64, &OutputBuffer, v16) < 0 )
    return v7;
  NextSession = (_EPROCESS *)MmGetNextSession(0i64);
  do
  {
    if( NextSession
      && (LODWORD(v12) = HalSystemVectorDispatchEntry((UINT32)Session, v8, v11),
          Session = NextSession->Session,
          *((_QWORD *)Session + 131) != v12) )
    {
      if( v4 == PsWin32SessionAttachAll )
      {
        NextSession = (_EPROCESS *)MmGetNextSession(NextSession);
        if( NextSession )
          continue;
      }
      else
      {
        v7 = -1073741811;
      }
      v6 = 1;
    }
    else
    {
      if( v4 == PsWin32SessionAttachAll && NextSession )
      {
        v13 = PsWin32SessionAttachSingle;
        SessionId = MmGetSessionId(NextSession);
        p_SessionId = (UINT64 *)&SessionId;
        NextSession = (_EPROCESS *)MmGetNextSession(NextSession);
        if( !NextSession )
          v6 = 1;
      }
      else
      {
        v6 = 1;
        v13 = v4;
        p_SessionId = a4;
        if( a4 )
          v18 = *(_DWORD *)a4;
        else
          v18 = -1;
      }
      if( OutputBuffer )
      {
        memset(InputBuffer, 0i64, 0x60u);
        LODWORD(v17) = 0;
        LODWORD(InputBuffer[0]) = 21;
        InputBuffer[1] = OutputBuffer;
        LODWORD(InputBuffer[3]) = 417;
        LODWORD(InputBuffer[2]) = 1000 * PopWin32kCalloutWatchdogTimeoutSeconds;
        HIDWORD(InputBuffer[2]) = v18;
        InputBuffer[4] = (__int64)KeGetCurrentThread();
        InputBuffer[10] = (__int64)InputBuffer;
        InputBuffer[9] = (__int64)PopWin32CalloutWatchdogCallbackLiveDump;
        ZwPowerInformation(PowerInformationInternal, InputBuffer, 0x60ui64, 0i64, v17);
      }
      v7 = PsInvokeWin32Callout(Operation, a2, v13, p_SessionId);
      if( OutputBuffer )
      {
        memset(InputBuffer, 0i64, 0x60u);
        LODWORD(InputBuffer[0]) = 21;
        InputBuffer[1] = OutputBuffer;
        LODWORD(v17) = 0;
        ZwPowerInformation(PowerInformationInternal, InputBuffer, 0x60ui64, 0i64, v17);
      }
    }
  }
  while( !v6 );
  if( OutputBuffer )
  {
    memset(InputBuffer, 0i64, 0x60u);
    LODWORD(InputBuffer[0]) = 21;
    InputBuffer[1] = OutputBuffer;
    LOBYTE(InputBuffer[11]) = 1;
    LODWORD(v17) = 0;
    ZwPowerInformation(PowerInformationInternal, InputBuffer, 0x60ui64, 0i64, v17);
  }
  return v7;
}

Referenced by: