ExRegisterExtension

NTSTATUS __stdcall ExRegisterExtension(INT64 *a1, INT64 a2, INT64 a3){
  _ETHREAD *CurrentThread; 
  _BYTE *v6; 
  _EX_HOST *Host; 
  unsigned int v8; 
  unsigned int v9; 
  _ETHREAD *v10; 
  volatile signed __int64 *v11; 
  _BYTE *v12; 
  _BYTE *v13; 
  void(__fastcall *v14)(_QWORD, _QWORD); 
  PVOID v15; 
  void(__fastcall *v16)(__int64, _QWORD); 
  char v17; 
  _QWORD *v18; 
  NTSTATUS v20; 

  if( (a2 & 0xFFFF0000) != 0x10000 || !*(_QWORD *)(a3 + 8) && *(_WORD *)(a3 + 4) )
    return -1073741811;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v6 = KeAbPreAcquire(&ExpHostListLock, 0i64, 0i64);
  if( _InterlockedCompareExchange64(&ExpHostListLock._bf_0, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&ExpHostListLock, v6, &ExpHostListLock);
  if( v6 )
    v6[26] |= 1u;
  Host = ExpFindHost(*(_WORD *)a3, *(_WORD *)(a3 + 2));
  if( _InterlockedCompareExchange64(&ExpHostListLock._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&ExpHostListLock);
  KeAbPostRelease(&ExpHostListLock);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( !Host )
    return -1073741275;
  v8 = *(unsigned __int16 *)(a3 + 4);
  if( (unsigned __int16)v8 < *((_WORD *)Host + 14) )
  {
    v20 = -1073741811;
LABEL_40:
    ExpDereferenceHost(Host);
    return v20;
  }
  v9 = 0;
  if( *(_WORD *)(a3 + 4) )
  {
    while( *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64 * v9) )
    {
      if( ++v9 >= v8 )
        goto LABEL_14;
    }
    v20 = -1073741790;
    goto LABEL_40;
  }
LABEL_14:
  v10 = (_ETHREAD *)KeGetCurrentThread();
  --v10->Tcb.KernelApcDisable;
  v11 = (volatile signed __int64 *)(Host + 18);
  v12 = KeAbPreAcquire(Host + 18, 0i64, 0i64);
  v13 = v12;
  if( _interlockedbittestandset64(Host + 18, 0i64) )
    ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Host + 9, v12, Host + 18);
  if( v13 )
    v13[26] |= 1u;
  if( *((_QWORD *)Host + 10) || (Host[22] & 1) != 0 )
  {
    if( (_InterlockedExchangeAdd64(v11, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)Host + 9);
    KeAbPostRelease(Host + 18);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    v20 = -1073741771;
    goto LABEL_40;
  }
  v14 = (void(__fastcall *)(_QWORD, _QWORD))*((_QWORD *)Host + 6);
  if( v14 )
    v14(0i64, *((_QWORD *)Host + 7));
  v15 = *(PVOID *)(a3 + 8);
  if( !v15 )
    v15 = MmBadPointer;
  *((_QWORD *)Host + 10) = v15;
  _InterlockedExchange64((volatile __int64 *)Host + 8, 0i64);
  v16 = (void(__fastcall *)(__int64, _QWORD))*((_QWORD *)Host + 6);
  if( v16 )
    v16(1i64, *((_QWORD *)Host + 7));
  v17 = _InterlockedExchangeAdd64(v11, 0xFFFFFFFFFFFFFFFFui64);
  if( (v17 & 2) != 0 && (v17 & 4) == 0 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)Host + 9);
  KeAbPostRelease(Host + 18);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  v18 = *(_QWORD **)(a3 + 16);
  if( v18 )
    *v18 = *((_QWORD *)Host + 5);
  *a1 = (INT64)Host;
  return 0;
}

Referenced by: