PsCallImageNotifyRoutines

VOID __stdcall PsCallImageNotifyRoutines(
        _UNICODE_STRING *FullImageName,
        PVOID ProcessId,
        _IMAGE_INFO_EX *ExtendedInfo,
        _FILE_OBJECT *FileObject){
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  __int64 v10; 
  IMAGE_INFO *p_ImageInfo; 
  INT64 *v12; 
  struct EX_RUNDOWN_REF *v13; 
  struct EX_RUNDOWN_REF *v14; 
  void(__fastcall *Count)(_UNICODE_STRING *, __int64, IMAGE_INFO *); 
  __int128 v16; 
  __int64 v17; 
  v16 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = 0i64;
  v17 = 0i64;
  if( KeAreAllApcsDisabled() )
    __int2c();
  if( FltMgrCallbacks
    && (*(int(__fastcall **)(_FILE_OBJECT *, __int64, __int128 *, __int64 *))(FltMgrCallbacks + 24))(
         FileObject,
         1024i64,
         &v16,
         &v17) >= 0 )
  {
    FullImageName = (_UNICODE_STRING *)&v16;
  }
  if( ProcessId )
    v9 = *((_QWORD *)ProcessId + 136);
  if( (PspNotifyEnableMask & 1) != 0 )
  {
    ExtendedInfo->ImageInfo.Properties |= 0x400u;
    v10 = 64i64;
    p_ImageInfo = &ExtendedInfo->ImageInfo;
    ExtendedInfo->Size = 56i64;
    ExtendedInfo->FileObject = FileObject;
    v12 = &PspLoadImageNotifyRoutine;
    do
    {
      v13 = ExReferenceCallBackBlock(v12);
      v14 = v13;
      if( v13 )
      {
        Count = (void(__fastcall *)(_UNICODE_STRING *, __int64, IMAGE_INFO *))v13[1].Count;
        if( ((p_ImageInfo->Properties & 0x800) == 0 || (v14[2].Count & 1) != 0) && Count )
          Count(FullImageName, v9, p_ImageInfo);
        ExDereferenceCallBackBlock(v12, v14);
      }
      ++v12;
      --v10;
    }
    while( v10 );
  }
  if( v17 )
    (*(void(**)(void))(FltMgrCallbacks + 32))();
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
}

Referenced by: