IopRegistryCallback

VOID __stdcall IopRegistryCallback(PVOID CallbackContext, _IO_STATUS_BLOCK *IoStatusBlock){
  WCHAR v2; 
  wchar_t *v3; 
  __int64 v4; 
  wchar_t **v5; 
  struct _IO_STATUS_BLOCK *v6; 
  bool v7; 
  BOOL WatchTree; 
  BOOL Asynchronous; 
  UNICODE_STRING Path; 
  UINT8 FoundFullPath; 
  PVOID Handle; 
  Handle = 0i64;
  v3 = (wchar_t *)(unsigned int)CallbackContext;
  v4 = 14i64 * (unsigned int)CallbackContext;
  Path = 0i64;
  FoundFullPath = 0;
  RtlInitUnicodeString(&Path, (&IopRegistryRegisteredCallbacks)[v4], v2);
  v5 = &(&IopRegistryRegisteredCallbacks)[v4];
  v5[8] = 0i64;
  v5[10] = (wchar_t *)IopRegistryCallback;
  v5[11] = v3;
  if( (*(_DWORD *)(&IopRegistryRegisteredCallbacks + v4 + 5) & 1) != 0 )
  {
    ((void(__fastcall *)(_QWORD))(&IopRegistryRegisteredCallbacks)[v4 + 1])(*(&IopRegistryRegisteredCallbacks + v4 + 3));
    LOBYTE(Asynchronous) = 1;
    v6 = (struct _IO_STATUS_BLOCK *)&(&IopRegistryRegisteredCallbacks)[v4 + 6];
    LOBYTE(WatchTree) = 1;
    if( ZwNotifyChangeKey(
           (&IopRegistryRegisteredCallbacks)[v4 + 2],
           0i64,
           (PIO_APC_ROUTINE)(v5 + 8),
           (PVOID)1,
           v6,
           *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v4 + 2),
           WatchTree,
           0i64,
           0,
           Asynchronous) >= 0 )
      return;
  }
  else
  {
    v6 = (struct _IO_STATUS_BLOCK *)&(&IopRegistryRegisteredCallbacks)[v4 + 6];
  }
  if( (int)IopRegistryOpenDeepestPath(&Path, &Handle, &FoundFullPath) < 0 )
    goto LABEL_10;
  ZwClose((&IopRegistryRegisteredCallbacks)[v4 + 2]);
  v7 = FoundFullPath == 1;
  (&IopRegistryRegisteredCallbacks)[v4 + 2] = (wchar_t *)Handle;
  if( v7 )
  {
    *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v4 + 10) |= 1u;
    ((void(__fastcall *)(_QWORD))(&IopRegistryRegisteredCallbacks)[v4 + 1])(*(&IopRegistryRegisteredCallbacks + v4 + 3));
  }
  LOBYTE(Asynchronous) = 1;
  LOBYTE(WatchTree) = 1;
  if( ZwNotifyChangeKey(
         (&IopRegistryRegisteredCallbacks)[v4 + 2],
         0i64,
         (PIO_APC_ROUTINE)(v5 + 8),
         (PVOID)1,
         v6,
         *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v4 + 2),
         WatchTree,
         0i64,
         0,
         Asynchronous) < 0 )
  {
LABEL_10:
    ZwClose((&IopRegistryRegisteredCallbacks)[v4 + 2]);
    *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v4 + 2) = 0;
  }
}

Referenced by: