NtNotifyChangeDirectoryFileEx

VOID __fastcall NtNotifyChangeDirectoryFileEx(){
  void *v0; 
  void *v1; 
  INT64 v2; 
  __int64 v3; 
  void *v4; 
  void *v5; 
  INT8 v6; 
  __int64 v7; 
  ULONG v8; 
  CHAR v9; 
  PFILE_OBJECT v10; 
  UINT64 v11; 
  NTSTATUS v12; 
  UINT8 v13; 
  UINT8 v14; 
  _DEVICE_OBJECT *RelatedDeviceObject; 
  IRP *Irp; 
  IRP *v17; 
  __int64 v18; 
  POOL_TYPE v19; 
  int v20; 
  char v21; 
  _ETHREAD *v22; 
  PFILE_OBJECT v23; 
  __int64 v24; 
  INT64 v25; 
  _WORD *PoolWithQuota; 
  _MDL *Mdl; 
  INT64 v28; 
  IRP *Object; 
  PVOID *Objecta; 
  UINT64 v31; 
  char v32; 
  PFILE_OBJECT FileObject; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID VirtualAddress; 
  _ETHREAD *CurrentThread; 
  VOID *retaddr; 
  INT64 v38; 
  __int64 v39; 
  UINT64 *v40; 
  volatile void *Address; 
  SIZE_T Length; 
  int v43; 
  char v44; 
  POOL_TYPE v45; 
  v39 = v3;
  v38 = v2;
  v4 = v0;
  v5 = v1;
  FileObject = 0i64;
  DmaAdapter = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = *((_BYTE *)CurrentThread + 562);
  if( !v6 )
  {
    v8 = Length;
    goto LABEL_8;
  }
  v7 = (__int64)v40;
  if( (unsigned __int64)v40 >= 0x7FFFFFFF0000i64 )
    v7 = 0x7FFFFFFF0000i64;
  *(_DWORD *)v7 = *(_DWORD *)v7;
  v8 = Length;
  if( (_DWORD)Length )
    ProbeForWrite((VOID *)Address, (unsigned int)Length, 4ui64);
  if( (v43 & 0xFFFFF000) == 0 && v43 )
  {
LABEL_8:
    v9 = 1;
    if( IopReferenceFileObject(v5, 1ui64, v6, &FileObject, 0i64) < 0 )
      return;
    v10 = FileObject;
    if( FileObject->CompletionContext && (v38 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
      goto LABEL_36;
    if( v4 )
    {
      VirtualAddress = 0i64;
      v12 = ObReferenceObjectByHandle(v4, 2u, (POBJECT_TYPE)ExEventObjectType, v6, &VirtualAddress, 0i64);
      DmaAdapter = (PADAPTER_OBJECT)VirtualAddress;
      if( v12 < 0 )
      {
LABEL_36:
        HalPutDmaAdapter((PADAPTER_OBJECT)v10);
        return;
      }
      KeResetEvent(VirtualAddress, v11, v13, v14, Object);
    }
    if( (v10->Flags & 2) != 0 )
    {
      v22 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v22 + 242);
      v23 = FileObject;
      LODWORD(v24) = KeAbPreAcquire(&FileObject->Lock, 0i64, 0i64);
      if( _InterlockedExchange((volatile __int32 *)&v23->Busy, 1) )
      {
        LOBYTE(v25) = v6;
        v10 = FileObject;
        IopWaitAndAcquireFileObjectLock(FileObject, v25);
      }
      else
      {
        if( v24 )
          *(_BYTE *)(v24 + 26) |= 1u;
        v10 = FileObject;
        ObfReferenceObject(FileObject);
      }
      v32 = 1;
    }
    else
    {
      v9 = 0;
      v32 = 0;
      if( v6 )
        IopMarkApcRoutineIfAsynchronousIo32(&v40, &v38, 0);
    }
    IopResetEvent(v10);
    RelatedDeviceObject = IoGetRelatedDeviceObject(v10);
    Irp = IopAllocateIrpExReturn(RelatedDeviceObject, *((_BYTE *)RelatedDeviceObject + 76), v9 ^ 1u, retaddr);
    v17 = Irp;
    VirtualAddress = Irp;
    if( !Irp )
    {
      IopAllocateIrpCleanup((PUNICODE_STRING)v10);
      return;
    }
    *((_QWORD *)Irp + 24) = v10;
    *((_QWORD *)Irp + 19) = CurrentThread;
    *((_BYTE *)Irp + 64) = v6;
    *((_QWORD *)Irp + 10) = DmaAdapter;
    *((_QWORD *)Irp + 9) = v40;
    *((_QWORD *)Irp + 11) = v38;
    *((_QWORD *)Irp + 12) = v39;
    v18 = *((_QWORD *)Irp + 23);
    *(_BYTE *)(v18 - 72) = 12;
    v19 = v45;
    *(_BYTE *)(v18 - 71) = (v45 == NonPagedPoolMustSucceed) + 2;
    *(_QWORD *)(v18 - 24) = v10;
    if( !v8 )
      goto LABEL_21;
    v20 = *((_DWORD *)RelatedDeviceObject + 12);
    if( (v20 & 4) != 0 )
    {
      PoolWithQuota = IopVerifierExAllocatePoolWithQuota(v19, v8);
      *((_QWORD *)v17 + 3) = PoolWithQuota;
      if( !IopDisableBufferedIoInit )
        memset((INT64)PoolWithQuota, 0i64);
      *((_DWORD *)v17 + 4) = 112;
      v9 = v32;
      v19 = v45;
    }
    else if( (v20 & 0x10) != 0 )
    {
      Mdl = IoAllocateMdl((PVOID)Address, v8, 0, 1u, v17);
      if( !Mdl )
        RtlRaiseStatus(-1073741670);
      LODWORD(Objecta) = *(unsigned __int8 *)(v18 - 72);
      IopProbeAndLockPages_1(Mdl, v6, v28, RelatedDeviceObject, (INT64)Objecta);
      v19 = v45;
      goto LABEL_21;
    }
    *((_QWORD *)v17 + 14) = Address;
LABEL_21:
    *(_DWORD *)(v18 - 64) = v8;
    *(_DWORD *)(v18 - 56) = v43;
    if( *(_BYTE *)(v18 - 71) == 3 )
      *(_DWORD *)(v18 - 48) = v19;
    *(_BYTE *)(v18 - 70) = 0;
    v21 = *(_BYTE *)(v18 - 70);
    if( v44 )
      v21 = 1;
    *(_BYTE *)(v18 - 70) = v21;
    LODWORD(v31) = 2;
    IopSynchronousServiceTail(RelatedDeviceObject, v17, v10, 0, v6, v9, v31);
  }
}

Referenced by: