IoInitializeRemoveLockEx
VOID __stdcall IoInitializeRemoveLockEx(
UINT32 AllocateTag,
UINT32 MaxLockedMinutes,
UINT32 HighWatermark,
UINT32 RemlockSize){
__int64 v4;
unsigned __int64 v5;
ULONG RemlockSizea;
v4 = *(_QWORD *)&AllocateTag;
if( *(_QWORD *)&AllocateTag )
{
if( RemlockSizea == 32 )
{
LABEL_3:
*(_BYTE *)v4 = 0;
*(_DWORD *)(v4 + 4) = 1;
*(_QWORD *)(v4 + 24) = v4 + 16;
*(_QWORD *)(v4 + 16) = v4 + 16;
*(_WORD *)(v4 + 8) = 1;
*(_BYTE *)(v4 + 10) = 6;
*(_DWORD *)(v4 + 12) = 0;
return;
}
if( RemlockSizea == 120 )
{
*(_DWORD *)(*(_QWORD *)&AllocateTag + 32i64) = 1129270354;
*(_DWORD *)(*(_QWORD *)&AllocateTag + 36i64) = RemlockSize;
v5 = HighWatermark * (unsigned __int64)KeMaximumIncrement;
*(_DWORD *)(v4 + 48) = MaxLockedMinutes;
*(_QWORD *)(v4 + 72) = 0i64;
*(_QWORD *)(v4 + 40) = 600000000 * v5;
*(_DWORD *)(v4 + 80) = 0;
*(_QWORD *)(v4 + 112) = 0i64;
goto LABEL_3;
}
}
}Referenced by:
PopFxCreateDeviceCommon
PopFxRegisterDeviceWorker
VfFilterAttach