ObpInsertCallbackByAltitude
NTSTATUS __stdcall ObpInsertCallbackByAltitude(_OBJECT_TYPE *ObjectType, _OB_CALLBACK_CONTEXT_BLOCK *ObCallbackContext){
_ETHREAD *CurrentThread;
_LIST_ENTRY *p_CallbackList;
NTSTATUS v4;
ULONG_PTR v6;
_LIST_ENTRY *Flink;
_LIST_ENTRY *Blink;
_LIST_ENTRY *v9;
_UNICODE_STRING *v11;
NTSTATUS v12;
bool v13;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
p_CallbackList = &ObjectType->CallbackList;
v4 = 0;
--CurrentThread->Tcb.SpecialApcDisable;
v6 = (_DWORD)ObjectType + 184;
ExAcquirePushLockExclusiveEx(&ObjectType->TypeLock, 0i64);
Flink = p_CallbackList->Flink;
if( p_CallbackList->Flink == p_CallbackList )
goto LABEL_2;
v11 = (_UNICODE_STRING *)*((_QWORD *)ObCallbackContext + 3);
while( 1 )
{
v12 = RtlCompareAltitudes((_UNICODE_STRING *)&Flink[1].Blink[1], v11 + 1);
v13 = v12 == 0;
if( v12 <= 0 )
break;
Flink = Flink->Flink;
if( Flink == p_CallbackList )
{
v13 = v12 == 0;
break;
}
}
if( !v13 )
{
LABEL_2:
Blink = Flink->Blink;
v9 = Blink->Flink;
if( Blink->Flink->Blink != Blink )
__fastfail(3u);
*(_QWORD *)ObCallbackContext = v9;
*((_QWORD *)ObCallbackContext + 1) = Blink;
v9->Blink = (_LIST_ENTRY *)ObCallbackContext;
Blink->Flink = (_LIST_ENTRY *)ObCallbackContext;
}
else
{
v4 = -1071906799;
}
ExReleasePushLockEx(v6, 0);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
return v4;
}Referenced by:
ObRegisterCallbacks