IopRegistryCallback

VOID __stdcall IopRegistryCallback(VOID *CallbackContext){
  wchar_t *v1; 
  __int64 v2; 
  wchar_t **v3; 
  _IO_STATUS_BLOCK *IoStatusBlock; 
  bool v5; 
  _UNICODE_STRING Path[2]; 
  UINT8 FoundFullPath; 
  VOID *Handle; 

  Handle = 0i64;
  v1 = (wchar_t *)(unsigned int)CallbackContext;
  v2 = 14i64 * (unsigned int)CallbackContext;
  Path[0] = 0i64;
  FoundFullPath = 0;
  RtlInitUnicodeString(Path, (&IopRegistryRegisteredCallbacks)[v2]);
  v3 = &(&IopRegistryRegisteredCallbacks)[v2];
  v3[8] = 0i64;
  v3[10] = (wchar_t *)IopRegistryCallback;
  v3[11] = v1;
  if( (*(_DWORD *)(&IopRegistryRegisteredCallbacks + v2 + 5) & 1) != 0 )
  {
    ((void(__fastcall *)(_QWORD))(&IopRegistryRegisteredCallbacks)[v2 + 1])(*(&IopRegistryRegisteredCallbacks + v2 + 3));
    IoStatusBlock = (_IO_STATUS_BLOCK *)&(&IopRegistryRegisteredCallbacks)[v2 + 6];
    if( ZwNotifyChangeKey(
           (_HANDLE)(&IopRegistryRegisteredCallbacks)[v2 + 2],
           0,
           (PIO_APC_ROUTINE)(v3 + 8),
           (PVOID)1,
           IoStatusBlock,
           *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v2 + 2),
           1u,
           0i64,
           0,
           1u) >= 0 )
      return;
  }
  else
  {
    IoStatusBlock = (_IO_STATUS_BLOCK *)&(&IopRegistryRegisteredCallbacks)[v2 + 6];
  }
  if( IopRegistryOpenDeepestPath(Path, &Handle, &FoundFullPath) < 0 )
    goto LABEL_10;
  ZwClose((_HANDLE)(&IopRegistryRegisteredCallbacks)[v2 + 2]);
  v5 = FoundFullPath == 1;
  (&IopRegistryRegisteredCallbacks)[v2 + 2] = (wchar_t *)Handle;
  if( v5 )
  {
    *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v2 + 10) |= 1u;
    ((void(__fastcall *)(_QWORD))(&IopRegistryRegisteredCallbacks)[v2 + 1])(*(&IopRegistryRegisteredCallbacks + v2 + 3));
  }
  if( ZwNotifyChangeKey(
         (_HANDLE)(&IopRegistryRegisteredCallbacks)[v2 + 2],
         0,
         (PIO_APC_ROUTINE)(v3 + 8),
         (PVOID)1,
         IoStatusBlock,
         *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v2 + 2),
         1u,
         0i64,
         0,
         1u) < 0 )
  {
LABEL_10:
    ZwClose((_HANDLE)(&IopRegistryRegisteredCallbacks)[v2 + 2]);
    *((_DWORD *)&IopRegistryRegisteredCallbacks + 2 * v2 + 2) = 0;
  }
}

Referenced by: