PopFxRegisterPluginEx

INT64 __fastcall PopFxRegisterPluginEx(UINT16 *a1, UINT64 a2, UINT16 *a3){
  UINT16 v3; 
  int v7; 
  bool v8; 
  UINT16 v10; 
  _DWORD *PoolWithTag; 
  _DWORD *v12; 
  _ETHREAD *CurrentThread; 
  _QWORD *v14; 
  __int64 v15; 
  _ETHREAD *v16; 
  unsigned int SessionId; 
  char v18; 
  int v19; 
  bool v20; 
  __int64 v21; 
  unsigned __int64 v22; 
  int v23; 
  unsigned int v24; 
  __int64 v25; 
  int v26; 
  v3 = *a3;
  if( *a3 > 3u )
    return(unsigned int)-1073700860;
  switch( v3 )
  {
    case 3u:
      v8 = a3[1] < 0x60u;
      break;
    case 2u:
      v8 = a3[1] < 0x58u;
      break;
    case 0u:
      return(unsigned int)-1073741811;
    default:
      goto LABEL_11;
  }
  if( v8 )
    return(unsigned int)-1073741811;
LABEL_11:
  if( a3[1] < 0x38u )
    return(unsigned int)-1073741811;
  v10 = *a1;
  if( *a1 > 3u )
    return(unsigned int)-1073700859;
  if( v10 == 3 )
  {
    if( a1[1] < 0x20u || !*((_QWORD *)a1 + 1) && !*((_QWORD *)a1 + 3) )
      return(unsigned int)-1073741811;
  }
  else if( v10 != 2 || a1[1] < 0x18u || !*((_QWORD *)a1 + 1) )
  {
    return(unsigned int)-1073741811;
  }
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x1A8ui64, 0x4D584650ui64);
  v12 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v7 = PopFxInitializeWorkPool(v12 + 30, (INT64)v12);
    if( v7 >= 0 )
    {
      v12[4] = *a1;
      *((_QWORD *)v12 + 3) = a2;
      *((_QWORD *)v12 + 12) = *((_QWORD *)a1 + 1);
      *((_QWORD *)v12 + 13) = *((_QWORD *)a1 + 2);
      if( *a1 >= 3u )
        *((_QWORD *)v12 + 14) = *((_QWORD *)a1 + 3);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&PopFxPluginLock, 0i64);
      v14 = (_QWORD *)PopFxDeviceRegisterHead;
      v15 = *(_QWORD *)PopFxDeviceRegisterHead;
      if( *(_QWORD *)(*(_QWORD *)PopFxDeviceRegisterHead + 8i64) != PopFxDeviceRegisterHead )
        __fastfail(3u);
      *((_QWORD *)v12 + 1) = PopFxDeviceRegisterHead;
      *(_QWORD *)v12 = v15;
      *(_QWORD *)(v15 + 8) = v12;
      *v14 = v12;
      if( (a2 & 0x80000000) != 0 )
        PopFxDeviceRegisterHead = (__int64)v12;
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&PopFxPluginLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)&PopFxPluginLock);
      v26 = 0;
      v16 = (_ETHREAD *)KeGetCurrentThread();
      if( (unsigned int)MiGetSystemRegionType((UINT64)&PopFxPluginLock) == 1 )
        SessionId = MmGetSessionIdEx(*((_QWORD *)v16 + 23));
      else
        SessionId = -1;
      --*((_WORD *)v16 + 243);
      v18 = ++*((_BYTE *)v16 + 794);
      v19 = (*((char *)v16 + 792) | *((char *)v16 + 870)) ^ 0x3F;
      while( 1 )
      {
        v20 = !_BitScanReverse((unsigned int *)&v21, v19);
        if( v20 )
          break;
        v22 = *((_QWORD *)v16 + 100) + 96 * v21;
        v19 &= ~(1 << v21);
        if( (*(_BYTE *)(v22 + 26) & 1) != 0
          && (*(_DWORD *)(v22 + 32) & 1) == 0
          && (*(_QWORD *)(v22 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&PopFxPluginLock & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v22 + 40) == SessionId )
        {
          *(_BYTE *)(v22 + 26) &= ~1u;
          if( *(_QWORD *)(v22 + 32) )
          {
            if( v22 )
            {
              *(_BYTE *)(v22 + 32) |= 2u;
              if( *(__int64 *)(v22 + 32) < 0 )
                KiAbEntryRemoveFromTree(v22);
              v23 = *(_DWORD *)(v22 + 88) & 0x1FFFF;
              v24 = *(_DWORD *)(v22 + 88) & 0xFFFE0000;
              *(_BYTE *)(v22 + 25) &= ~1u;
              v26 = v23;
              *(_DWORD *)(v22 + 88) = v24;
              *(_QWORD *)(v22 + 32) = 0i64;
              v25 = (__int64)(v22 - *((_QWORD *)v16 + 100)) / 96;
              if( v18 == 1 )
                *((_BYTE *)v16 + 792) |= 1 << v25;
              else
                _InterlockedOr8((volatile signed __int8 *)v16 + 870, 1 << v25);
              goto LABEL_50;
            }
            break;
          }
        }
      }
      if( (*((_DWORD *)v16 + 30) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, (ULONG_PTR)v16, (ULONG_PTR)&PopFxPluginLock, SessionId, 0i64);
LABEL_50:
      --*((_BYTE *)v16 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v16, (__int64)&PopFxPluginLock, (unsigned int *)&v26);
      v20 = (*((_WORD *)v16 + 243))++ == 0xFFFF;
      if( v20 && *((_ETHREAD **)v16 + 19) != (_ETHREAD *)((char *)v16 + 152) )
        KiCheckForKernelApcDelivery();
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      PopDiagTraceFxPluginRegistration(v12, a2, 0);
      *((_QWORD *)a3 + 4) = 0i64;
      *((_QWORD *)a3 + 5) = 0i64;
      *((_QWORD *)a3 + 3) = 0i64;
      v8 = *a3 < 2u;
      *((_QWORD *)a3 + 2) = PopFxRequestWorker;
      *((_QWORD *)a3 + 6) = PopFxTransitionCriticalResource;
      *((_QWORD *)a3 + 1) = v12;
      if( !v8 )
      {
        *((_QWORD *)a3 + 7) = PopFxProcessorIdleVeto;
        *((_QWORD *)a3 + 8) = PopFxPlatformIdleVeto;
        *((_QWORD *)a3 + 9) = PopFxUpdateProcessorIdleState;
        *((_QWORD *)a3 + 10) = PopFxUpdatePlatformIdleState;
      }
      if( *a1 >= 3u )
      {
        *((_QWORD *)a3 + 11) = PopFxRequestCommon;
        if( *a1 == 3 )
        {
          if( *((_QWORD *)a1 + 3) )
            PopFxAcpiPepRegistered = 1;
        }
      }
      return 0;
    }
    else
    {
      ExFreePoolWithTag(v12, 0x4D584650u);
    }
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)v7;
}

Referenced by: