PoGetRequester

void __fastcall PoGetRequester(int PreviousMode, _DEVICE_OBJECT *DeviceObject, _DIAGNOSTIC_CONTEXT *Requester){
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int16 v7; 
  __int64 v8; 
  if( (_BYTE)PreviousMode )
  {
    v8 = 0i64;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
      v4 = 0i64;
    else
      v4 = *((_QWORD *)CurrentThread + 30);
    if( v4 )
    {
      if( *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1408i64)
        && (v6 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1408i64)) != 0
        && ((v7 = *(_WORD *)(v6 + 8), v7 == 332) || v7 == 452) )
      {
        v5 = *(unsigned int *)(v4 + 12128);
      }
      else
      {
        v5 = *(_QWORD *)(v4 + 5920);
      }
      v8 = v5;
    }
    Requester->CallerType = (v8 != 0) + 1;
    Requester->Process = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
    Requester->ServiceTag = v8;
  }
  else
  {
    Requester->CallerType = KernelRequester;
    Requester->Process = (_EPROCESS *)DeviceObject;
    if( DeviceObject )
      ObfReferenceObjectWithTag(DeviceObject, 0x67446F50u);
  }
}

Referenced by: