PsInvokeWin32Callout

NTSTATUS __stdcall PsInvokeWin32Callout(
        _WIN32_CALLOUTS_OPERATION Operation,
        VOID *Parameters,
        PS_WIN32_SESSION_ATTACH_MODE AttachMode,
        UINT64 *SessionId){
  UINT64 *v4; 
  VOID *v5; 
  _RTL_RUN_ONCE *Win32Callouts; 
  _EX_RUNDOWN_REF *v8; 
  _EX_RUNDOWN_REF *v9; 
  int v10; 
  __int32 v12; 
  _EPROCESS *Process; 
  NTSTATUS v14; 
  _DWORD *v15; 
  _RTL_RUN_ONCE *v16; 
  UINT64 *v17; 
  INT64 CallBackStatus; 

  LODWORD(CallBackStatus) = 0;
  v4 = SessionId;
  v5 = (VOID *)(int)Operation;
  if( AttachMode == PsWin32SessionAttachNone )
  {
    Win32Callouts = MmSessionGetWin32Callouts();
    v8 = ExReferenceCallBackBlock((INT64 *)Win32Callouts);
    v9 = v8;
    if( v8 )
    {
      v10 = ((__int64(__fastcall *)(unsigned __int64, VOID *, VOID *))v8[1].Count)(v8[2].Count, v5, Parameters);
      ExDereferenceCallBackBlock((_EX_CALLBACK *)Win32Callouts, v9);
      return v10;
    }
    return -1073741811;
  }
  v12 = AttachMode - 1;
  if( v12 )
  {
    if( v12 != 1 )
      return -1073741811;
    v17 = 0i64;
  }
  else
  {
    Process = KeGetCurrentThread()->ApcState.Process;
    if( (Process->Flags & 0x10000) != 0 )
    {
      v14 = MmGetSessionId(Process);
      if( *v15 == v14 )
      {
        v16 = MmSessionGetWin32Callouts();
        return ExCallCallBack((_EX_CALLBACK *)v16, v5, Parameters);
      }
    }
    v17 = v4;
  }
  v10 = ExCallSessionCallBack(v17, v5, Parameters, &CallBackStatus);
  if( v10 >= 0 )
    return CallBackStatus;
  return v10;
}

Referenced by: