WmipWriteWnodeToObject

INT64 __fastcall WmipWriteWnodeToObject(INT64 a1, UINT64 *a2, CHAR a3){
  __int64 v6; 
  unsigned int v7; 
  char v8; 
  unsigned int v9; 
  __int64 v10; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  memset(&LockHandle, 0, sizeof(LockHandle));
  KeAcquireInStackQueuedSpinLock(&WmipCancelSpinLock, &LockHandle);
  v6 = *(_QWORD *)(a1 + 72);
  v7 = 0;
  if( v6 )
  {
    WmipClearIrpObjectList(*(IRP **)(a1 + 72));
    v6 &= -(__int64)(_InterlockedExchange64((volatile __int64 *)(v6 + 104), 0i64) != 0);
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  v8 = 1;
  __writecr8(LockHandle.OldIrql);
  if( !v6 )
    return(unsigned int)WmipQueueNotification(
                           (KEVENT *)a1,
                           a1 + (-(__int64)(a3 != 0) & 0xFFFFFFFFFFFFFFE0ui64) + 128,
                           a2);
  v9 = *(_DWORD *)a2;
  v10 = *(_QWORD *)(v6 + 24);
  if( *(_DWORD *)a2 > *(_DWORD *)(*(_QWORD *)(v6 + 184) + 8i64) )
  {
    *(_DWORD *)(v10 + 48) = v9;
    *(_DWORD *)v10 = 56;
    v9 = 56;
    *(_DWORD *)(v10 + 44) = 32;
  }
  else
  {
    memmove((UINT8 *)v10, (UINT8 *)a2, v9);
    v8 = 0;
  }
  *(_QWORD *)(v6 + 56) = v9;
  *(_DWORD *)(v6 + 48) = 0;
  IofCompleteRequest((_IRP *)v6, 0);
  if( v8 )
    return(unsigned int)WmipQueueNotification(
                           (KEVENT *)a1,
                           a1 + (-(__int64)(a3 != 0) & 0xFFFFFFFFFFFFFFE0ui64) + 128,
                           a2);
  return v7;
}

Referenced by:

WmipProcessEvent