FsFilterPerformCallbacks
INT64 __fastcall FsFilterPerformCallbacks(INT64 a1, CHAR a2, CHAR a3, _DWORD *a4){
__int64 v4;
UINT8 v9;
__int64 v10;
__int16 v11;
PFS_FILTER_CALLBACK v12;
PFS_FILTER_COMPLETION_CALLBACK v13;
unsigned __int16 v14;
_QWORD *v15;
_QWORD *v16;
INT64 result;
PFS_FILTER_COMPLETION_CALLBACK PostOperationCallback;
PFS_FILTER_CALLBACK PreOperationCallback;
v4 = *(_QWORD *)(a1 + 8);
PreOperationCallback = 0i64;
PostOperationCallback = 0i64;
*a4 = 2;
if( !v4 )
return 0i64;
while( 1 )
{
v9 = *(_BYTE *)(a1 + 4);
v10 = *(_QWORD *)(*(_QWORD *)(v4 + 312) + 48i64);
*(_QWORD *)(a1 + 8) = v4;
FsFilterGetCallbacks(v9, (PDEVICE_OBJECT)v4, &PreOperationCallback, &PostOperationCallback);
v12 = PreOperationCallback;
v13 = PostOperationCallback;
if( !PreOperationCallback )
break;
if( PostOperationCallback )
goto LABEL_4;
v15 = 0i64;
LABEL_7:
if( !v12 )
goto LABEL_13;
if( v15 )
v16 = v15 + 2;
else
v16 = 0i64;
result = ((__int64(__fastcall *)(INT64, _QWORD *))v12)(a1, v16);
if( (int)result < 0 )
{
if( !a2 )
{
if( !v10 )
goto LABEL_36;
goto LABEL_12;
}
if( !v10 )
{
LABEL_36:
if( !a3 )
KeBugCheckEx(0x22u, (int)result, 0i64, 0x38Cui64, 0i64);
*a4 |= 1u;
}
if( !v15 )
return result;
LABEL_40:
--*(_WORD *)(a1 + 74);
return result;
}
if( (_DWORD)result )
{
if( !v15 )
return result;
goto LABEL_40;
}
LABEL_12:
v11 = -1;
LABEL_13:
if( v4 == *(_QWORD *)(a1 + 8) )
{
if( !v10 )
{
if( v15 )
*(_WORD *)(a1 + 74) += v11;
}
v4 = *(_QWORD *)(*(_QWORD *)(v4 + 312) + 48i64);
}
else
{
*(_DWORD *)(a1 + 64) |= 4u;
v4 = *(_QWORD *)(a1 + 8);
}
LABEL_16:
if( !v4 )
return 0i64;
}
if( !PostOperationCallback )
{
v4 = *(_QWORD *)(*(_QWORD *)(v4 + 312) + 48i64);
if( !v10 )
*a4 &= ~2u;
goto LABEL_16;
}
LABEL_4:
v14 = *(_WORD *)(a1 + 74);
if( v14 < *(_WORD *)(a1 + 72) )
{
v15 = (_QWORD *)(*(_QWORD *)(a1 + 80) + 32i64 * *(unsigned __int16 *)(a1 + 74));
*(_WORD *)(a1 + 74) = v14 + 1;
if( v15 )
{
*v15 = v4;
v15[1] = *(_QWORD *)(a1 + 16);
v15[2] = 0i64;
v15[3] = v13;
goto LABEL_7;
}
}
if( !a2 )
KeBugCheckEx(0x22u, 0i64, 0i64, 0i64, 0i64);
return 3221225626i64;
}Referenced by:
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlQueryOpen
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite