FsRtlNotifyFilterChangeDirectoryLite

VOID __fastcall FsRtlNotifyFilterChangeDirectoryLite(
        volatile INT64 *a1,
        LIST_ENTRY *a2,
        VOID *a3,
        CHAR a4,
        INT64 a5,
        IRP *Irp,
        INT64 a7,
        SECURITY_SUBJECT_CONTEXT *SubjectContext,
        INT64 a9){
  IRP *v12; 
  _ETHREAD *CurrentThread; 
  volatile INT64 v14; 
  unsigned int v15; 
  __int64 v16; 
  LIST_ENTRY *v17; 
  unsigned int *PoolWithTag; 
  __int16 Blink; 
  UINT64 v20; 
  _QWORD *v21; 
  VOID **v22; 
  _LIST_ENTRY *v23; 
  _LIST_ENTRY *v24; 
  SECURITY_SUBJECT_CONTEXT *v25; 
  INT64 v26; 
  PNOTIFY_SYNC NotifySync; 
  VOID *FsContext; 
  FsContext = a3;
  v12 = Irp;
  if( a2->Flink == a2 && !Irp )
    return;
  if( !*a1 )
  {
    NotifySync = 0i64;
    FsRtlNotifyInitializeSync(&NotifySync);
    if( _InterlockedCompareExchange64(a1, (signed __int64)NotifySync, 0i64) )
      FsRtlNotifyUninitializeSync(&NotifySync);
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v14 = *a1;
  if( CurrentThread != *(_ETHREAD **)(*a1 + 56) )
  {
    ExAcquireFastMutexUnsafe(*(PFAST_MUTEX *)a1);
    *(_QWORD *)(*a1 + 56) = CurrentThread;
    v14 = *a1;
  }
  LOBYTE(v15) = 1;
  ++*(_DWORD *)(v14 + 64);
  if( !v12 )
  {
    FsRtlCheckNotifyForDeleteLite(a2);
    goto LABEL_32;
  }
  v16 = *((_QWORD *)v12 + 23);
  *((_DWORD *)v12 + 12) = 0;
  *((_QWORD *)v12 + 7) = 0i64;
  if( (*(_DWORD *)(*(_QWORD *)(v16 + 48) + 80i64) & 0x4000) != 0 )
    goto LABEL_26;
  v17 = FsRtlIsNotifyOnList(a2, FsContext);
  PoolWithTag = (unsigned int *)v17;
  if( v17 )
  {
    Blink = (__int16)v17[4].Blink;
    if( (Blink & 4) == 0 )
    {
      if( (Blink & 0x20) == 0 )
      {
        if( (Blink & 2) != 0 && (Blink & 8) == 0 )
        {
          *((_WORD *)PoolWithTag + 36) = Blink & 0xFFFD;
          *(_BYTE *)(*((_QWORD *)v12 + 23) + 3i64) |= v15;
          *((_DWORD *)v12 + 12) = 268;
          goto LABEL_27;
        }
        v20 = PoolWithTag[26];
        if( (_DWORD)v20 && (Blink & 8) == 0 )
        {
          *((_QWORD *)PoolWithTag + 13) = 0i64;
          LODWORD(v26) = 0;
          FsRtlNotifyCompleteIrp(v12, (INT64)PoolWithTag, v20, 0i64, v26);
          goto LABEL_32;
        }
        goto LABEL_13;
      }
      *(_BYTE *)(v16 + 3) |= v15;
      *((_DWORD *)v12 + 12) = -1073741738;
LABEL_27:
      IofCompleteRequest(v12, v15);
      goto LABEL_32;
    }
LABEL_26:
    *(_BYTE *)(v16 + 3) |= v15;
    *((_DWORD *)v12 + 12) = 267;
    goto LABEL_27;
  }
  PoolWithTag = (unsigned int *)ExAllocatePoolWithTag((_POOL_TYPE)17, 0x80ui64, 0x4E725346ui64);
  memset((INT64)PoolWithTag, 0i64);
  *((_WORD *)PoolWithTag + 36) |= 0x40u;
  *(_QWORD *)PoolWithTag = *a1;
  *((_QWORD *)PoolWithTag + 1) = FsContext;
  *((_QWORD *)PoolWithTag + 2) = a7;
  *((_QWORD *)PoolWithTag + 3) = SubjectContext;
  SubjectContext = 0i64;
  *((_QWORD *)PoolWithTag + 8) = a9;
  *((_QWORD *)PoolWithTag + 7) = PoolWithTag + 12;
  *((_QWORD *)PoolWithTag + 6) = PoolWithTag + 12;
  v15 = 1;
  if( (a4 & 1) != 0 )
    *((_WORD *)PoolWithTag + 36) |= 1u;
  if( (a4 & 4) != 0 )
    *((_WORD *)PoolWithTag + 36) |= 0x80u;
  PoolWithTag[19] = a5;
  if( (a4 & 2) == 0 )
    PoolWithTag[24] = *(_DWORD *)(v16 + 8);
  *((_QWORD *)PoolWithTag + 15) = *(_QWORD *)(*((_QWORD *)v12 + 19) + 544i64);
  v23 = (_LIST_ENTRY *)(PoolWithTag + 8);
  v24 = a2->Blink;
  if( v24->Flink != a2 )
LABEL_31:
    __fastfail(3u);
  v23->Flink = a2;
  *((_QWORD *)PoolWithTag + 5) = v24;
  v24->Flink = v23;
  a2->Blink = v23;
  PoolWithTag[28] = 1;
  v16 = *((_QWORD *)v12 + 23);
LABEL_13:
  *((_QWORD *)v12 + 7) = PoolWithTag;
  *(_BYTE *)(v16 + 3) |= v15;
  v21 = (_QWORD *)((char *)v12 + 168);
  v22 = (VOID **)*((_QWORD *)PoolWithTag + 7);
  if( *v22 != PoolWithTag + 12 )
    goto LABEL_31;
  *v21 = PoolWithTag + 12;
  *((_QWORD *)v12 + 22) = v22;
  *v22 = v21;
  *((_QWORD *)PoolWithTag + 7) = v21;
  _InterlockedAdd((volatile signed __int32 *)PoolWithTag + 28, v15);
  FsRtlNotifySetCancelRoutine((__int64)v12, 0i64);
LABEL_32:
  if( !--*(_DWORD *)(*a1 + 64) )
  {
    *(_QWORD *)(*a1 + 56) = 0i64;
    ExReleaseFastMutexUnsafe(*(PFAST_MUTEX *)a1);
  }
  v25 = SubjectContext;
  if( SubjectContext )
  {
    SeReleaseSubjectContext(SubjectContext);
    ExFreePoolWithTag(v25, 0);
  }
}

Referenced by: