CmRegisterMachineHiveLoadedNotification
INT64 __fastcall CmRegisterMachineHiveLoadedNotification(WCHAR *a1, WCHAR *a2, const UNICODE_STRING *a3, WCHAR ***a4){
INT64 result;
wchar_t **PoolWithTag;
wchar_t **v9;
wchar_t ***v10;
if( !a1 )
return 3221225711i64;
if( !a3 )
return 3221225713i64;
if( !a4 )
return 3221225714i64;
result = CmpFindMachineHiveByMountPoint(a3);
if( (int)result >= 0 )
{
PoolWithTag = (wchar_t **)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x32394D43ui64);
v9 = PoolWithTag;
if( PoolWithTag )
{
*PoolWithTag = 0i64;
PoolWithTag[1] = 0i64;
*((_BYTE *)PoolWithTag + 39) = 0;
*((_WORD *)PoolWithTag + 18) = 0;
PoolWithTag[2] = a1;
PoolWithTag[3] = a2;
*((_DWORD *)PoolWithTag + 8) = 0;
*((_BYTE *)PoolWithTag + 38) = 0;
ExAcquirePushLockExclusiveEx((UINT64)&CmpMachineHiveList[18], 0i64);
v10 = (wchar_t ***)CmpMachineHiveList[20];
if( *v10 != &CmpMachineHiveList[19] )
__fastfail(3u);
v9[1] = (wchar_t *)v10;
*v9 = (wchar_t *)&CmpMachineHiveList[19];
*v10 = v9;
CmpMachineHiveList[20] = (wchar_t *)v9;
*((_BYTE *)v9 + 37) = 1;
ExReleasePushLockEx((UINT64)&CmpMachineHiveList[18], 0i64);
ExAcquirePushLockExclusiveEx((UINT64)&CmpMachineHiveList[17], 0i64);
if( HIDWORD(CmpMachineHiveList[14]) == 1
&& _InterlockedIncrement((volatile signed __int32 *)&CmpMachineHiveList[22]) == 1 )
{
ExQueueWorkItem((WORK_QUEUE_ITEM *)CmpMachineHiveList[21], DelayedWorkQueue);
}
ExReleasePushLockEx((UINT64)&CmpMachineHiveList[17], 0i64);
result = 0i64;
*a4 = v9;
}
else
{
return 3221225626i64;
}
}
return result;
}Referenced by:
CmFcManagerStartRuntimePhase