FsRtlNotifySetCancelRoutine
char __fastcall FsRtlNotifySetCancelRoutine(__int64 a1, __int64 a2){
char v3;
__int64 v6;
KIRQL v7;
v3 = 0;
*(_BYTE *)(a1 + 69) = KeAcquireQueuedSpinLock(7ui64);
if( a2 )
{
v6 = _InterlockedExchange64((volatile __int64 *)(a1 + 104), 0i64);
v7 = *(_BYTE *)(a1 + 69);
*(_QWORD *)(a1 + 56) = 0i64;
KeReleaseQueuedSpinLock(7ui64, v7);
if( v6 )
{
_InterlockedDecrement((volatile signed __int32 *)(a2 + 112));
return 1;
}
}
else if( *(_BYTE *)(a1 + 68) )
{
FsRtlCancelNotify(0i64, (_IRP *)a1);
}
else
{
_InterlockedExchange64((volatile __int64 *)(a1 + 104), (__int64)FsRtlCancelNotify);
KeReleaseQueuedSpinLock(7ui64, *(_BYTE *)(a1 + 69));
}
return v3;
}Referenced by:
FsRtlNotifyCompleteIrp
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterChangeDirectoryLite