IopSendMessageToTrackService

NTSTATUS __stdcall IopSendMessageToTrackService(
        _LINK_TRACKING_INFORMATION *SourceVolumeId,
        _FILE_OBJECTID_BUFFER *SourceObjectId,
        _FILE_TRACKING_INFORMATION *TargetObjectInformation){
  int v6; 
  char PreviousMode; 
  NTSTATUS result; 
  NTSTATUS v9; 
  int v10; 
  VOID **Pool_1; 
  VOID **v12; 
  unsigned int ObjectInformationLength; 
  unsigned int v14; 
  size_t v15; 
  NTSTATUS v16; 
  __int64 WaitMode[2]; 
  __int64 BufferLength[5]; 
  NTSTATUS v19; 

  v6 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  while( 1 )
  {
    if( !IopLinkTrackingServiceObject )
    {
      if( !*(_DWORD *)(IopLinkTrackingServiceEvent + 4) )
        return -1073741153;
      result = KeWaitForSingleObject((UINT64)&stru_140C452E0 + 2592, 0, PreviousMode, 0, 0i64);
      if( result == 192 || result == 257 )
        return result;
      if( IopLinkTrackingServiceObject )
      {
        KeSetEvent((PRKEVENT)((char *)&stru_140C452E0 + 2592), 0, 0);
      }
      else
      {
        *(&stru_140C452E0 + 316) = 0i64;
        *(&stru_140C452E0 + 318) = IopConnectLinkTrackingPort;
        *(&stru_140C452E0 + 319) = (char *)&stru_140C452E0 + 2528;
        KeResetEvent((_KEVENT *)((char *)&stru_140C452E0 + 2560));
        ExQueueWorkItem((PWORK_QUEUE_ITEM)&stru_140C452E0 + 79, DelayedWorkQueue);
        v9 = KeWaitForSingleObject((UINT64)&stru_140C452E0 + 2560, 0, PreviousMode, 0, 0i64);
        v10 = v9;
        if( v9 != 192 && v9 != 257 && *(&stru_140C452E0 + 646) < 0 )
          v10 = *(&stru_140C452E0 + 646);
        KeSetEvent((PRKEVENT)((char *)&stru_140C452E0 + 2592), 0, 0);
        if( v10 )
          return v10;
      }
    }
    Pool_1 = IopVerifierExAllocatePool_1(1ui64, 0xB8ui64);
    v12 = Pool_1;
    if( !Pool_1 )
      break;
    memset((char *)Pool_1 + 44, 0i64, 0x8Cu);
    v12[5] = 0i64;
    *((_OWORD *)v12 + 3) = *(_OWORD *)&SourceVolumeId->Type;
    *((_DWORD *)v12 + 16) = *(_DWORD *)&SourceVolumeId->VolumeId[12];
    *(_OWORD *)((char *)v12 + 68) = *(_OWORD *)SourceObjectId->ObjectId;
    *(_OWORD *)((char *)v12 + 84) = *(_OWORD *)SourceObjectId->BirthVolumeId;
    *(_OWORD *)((char *)v12 + 100) = *(_OWORD *)&SourceObjectId->ExtendedInfo[16];
    *(_OWORD *)((char *)v12 + 116) = *(_OWORD *)&SourceObjectId->ExtendedInfo[32];
    if( TargetObjectInformation->ObjectInformationLength < 0x24 )
    {
      ExFreePoolWithTag(v12, 0);
      return -2147483643;
    }
    *((_DWORD *)v12 + 33) = *(_DWORD *)TargetObjectInformation->ObjectInformation;
    *(_FILE_TRACKING_INFORMATION *)(v12 + 17) = TargetObjectInformation[1];
    *(_FILE_TRACKING_INFORMATION *)(v12 + 19) = TargetObjectInformation[2];
    ObjectInformationLength = TargetObjectInformation->ObjectInformationLength;
    if( ObjectInformationLength > 0x24 )
    {
      v14 = ObjectInformationLength - 36;
      v15 = 16;
      if( v14 <= 0x10 )
        v15 = v14;
      memmove(v12 + 21, &TargetObjectInformation[3], v15);
    }
    *v12 = (VOID *)12058768;
    WaitMode[0] = 256i64;
    v16 = LpcSendWaitReceivePort(
            (INT64)IopLinkTrackingServiceObject,
            0x20000i64,
            (__m256i *)v12,
            (UINT64)BufferLength,
            WaitMode,
            0i64);
    v10 = v16;
    if( v16 != -1073741769 && v16 != -1073740029
      || (v10 = KeWaitForSingleObject((UINT64)&stru_140C452E0 + 2592, 0, PreviousMode, 0, 0i64),
          HalPutDmaAdapter(IopLinkTrackingServiceObject),
          IopLinkTrackingServiceObject = 0i64,
          KeSetEvent((PRKEVENT)((char *)&stru_140C452E0 + 2592), 0, 0),
          v6) )
    {
      if( v10 >= 0 )
        return v19;
      return v10;
    }
    v6 = 1;
  }
  return -1073741670;
}

Referenced by: