PspCallProcessNotifyRoutines

INT64 __fastcall PspCallProcessNotifyRoutines(struct EX_RUNDOWN_REF *a1, INT64 a2, CHAR a3){
  void(__fastcall **ExtensionTable)(_QWORD, _QWORD, _QWORD); 
  UINT64 v7; 
  unsigned __int64 Count; 
  unsigned int v9; 
  unsigned int v10; 
  int v11; 
  __int128 v12; 
  PADAPTER_OBJECT v13; 
  INT64 p_DmaOperations; 
  __int64 v15; 
  __int64 v16; 
  INT64 *p_result; 
  unsigned int v18; 
  struct EX_RUNDOWN_REF *v19; 
  __int64 v20; 
  struct EX_RUNDOWN_REF *v21; 
  int v23; 
  signed int v24; 
  __int64 *v25; 
  void(__fastcall **v26)(_QWORD, _QWORD, _QWORD); 
  unsigned __int64 v27; 
  void(__fastcall **v28)(struct EX_RUNDOWN_REF *, unsigned __int64, INT64 *); 
  INT64 result; 
  int v30; 
  unsigned __int64 v31; 
  __int128 v32; 
  __int64 v33; 
  __int128 v34; 
  int v35; 
  char v36; 
  PADAPTER_OBJECT DmaAdapter; 
  memset((INT64)&result, 0i64);
  ExtensionTable = (void(__fastcall **)(_QWORD, _QWORD, _QWORD))ExGetExtensionTable(PspDamExtensionHost);
  v26 = ExtensionTable;
  v7 = ExGetExtensionTable(PspBamExtensionHost);
  Count = a1[280].Count;
  v9 = 0;
  v10 = ((unsigned int)PspNotifyEnableMask >> 2) & 1;
  v28 = (void(__fastcall **)(struct EX_RUNDOWN_REF *, unsigned __int64, INT64 *))v7;
  DmaAdapter = 0i64;
  v36 = 0;
  v27 = Count;
  if( !a3 || (PspNotifyEnableMask & 4) == 0 && !ExtensionTable && !v7 )
  {
    p_result = 0i64;
    goto LABEL_17;
  }
  v11 = 0;
  result = 72i64;
  if( Count )
    v11 = 2;
  v30 = v11;
  v31 = a1[168].Count;
  v12 = *(_OWORD *)((char *)KeGetCurrentThread() + 1144);
  v35 = 0;
  v32 = v12;
  if( Count )
  {
    v33 = 0i64;
    v34 = 0i64;
    if( !a2 )
      goto LABEL_16;
    v25 = *(__int64 **)(a2 + 456);
    if( !v25 )
      goto LABEL_16;
    v33 = *v25;
    *(_QWORD *)&v34 = v25[1];
    v16 = v25[2];
  }
  else
  {
    if( a2 && (v13 = *(PADAPTER_OBJECT *)(a2 + 176)) != 0i64 )
    {
      DmaAdapter = *(PADAPTER_OBJECT *)(a2 + 176);
    }
    else
    {
      v36 = 1;
      PsReferenceProcessFilePointer(a1, (unsigned __int64 *)&DmaAdapter);
      v13 = DmaAdapter;
    }
    v33 = (__int64)v13;
    if( a2 && (*(_DWORD *)(a2 + 4) & 0x20) != 0 )
    {
      v30 |= 1u;
      p_DmaOperations = a2 + 232;
    }
    else
    {
      p_DmaOperations = (INT64)&v13[5].DmaOperations;
    }
    *(_QWORD *)&v34 = p_DmaOperations;
    if( !a2 || (v15 = *(_QWORD *)(a2 + 208)) == 0 )
    {
      *((_QWORD *)&v34 + 1) = 0i64;
      goto LABEL_16;
    }
    v16 = v15 + 112;
  }
  *((_QWORD *)&v34 + 1) = v16;
LABEL_16:
  p_result = &result;
LABEL_17:
  if( (PspNotifyEnableMask & 2) != 0 || (_BYTE)v10 )
  {
    v18 = 0;
    while( 1 )
    {
      v19 = ExReferenceCallBackBlock((INT64 *)&PspCreateProcessNotifyRoutine.Ptr + v18);
      v21 = v19;
      if( v19 )
      {
        v23 = v19[2].Count;
        if( !v27 || (v23 & 4) != 0 )
        {
          if( (v23 & 2) != 0 )
          {
            if( (_BYTE)v10 )
              ((void(__fastcall *)(struct EX_RUNDOWN_REF *, unsigned __int64, INT64 *))v21[1].Count)(
                a1,
                a1[136].Count,
                p_result);
          }
          else
          {
            LOBYTE(v20) = a3;
            ((void(__fastcall *)(unsigned __int64, unsigned __int64, __int64))v21[1].Count)(
              a1[168].Count,
              a1[136].Count,
              v20);
          }
        }
        ExDereferenceCallBackBlock((INT64 *)&PspCreateProcessNotifyRoutine.Ptr + v18, v21);
        if( p_result )
        {
          v24 = *((_DWORD *)p_result + 16);
          if( v24 < 0 )
            break;
        }
      }
      if( ++v18 >= 0x40 )
        goto LABEL_21;
    }
    v9 = *((_DWORD *)p_result + 16);
    PsTerminateProcess((ULONG_PTR)a1, v24);
LABEL_21:
    ExtensionTable = v26;
  }
  if( v28 && (!p_result || *((int *)p_result + 16) >= 0) )
  {
    (*v28)(a1, a1[136].Count, p_result);
    ExReleaseExtensionTable(PspBamExtensionHost);
  }
  if( ExtensionTable && (!p_result || *((int *)p_result + 16) >= 0) )
  {
    (*ExtensionTable)(a1, a1[136].Count, p_result);
    ExReleaseExtensionTable(PspDamExtensionHost);
  }
  if( v36 )
    HalPutDmaAdapter(DmaAdapter);
  return v9;
}

Referenced by: