CmpReportNotifyHelper

VOID __fastcall CmpReportNotifyHelper(INT64 a1, INT64 a2, INT64 a3, INT64 a4, LIST_ENTRY *ExternalDeferredPostAsync){
  INT16 v6; 
  int v8; 
  volatile INT64 *v10; 
  INT64 KcbAtLayerHeight; 
  unsigned __int8 CurrentIrql; 
  INT64 i; 
  __int64 v14; 
  _CM_TRANS_PTR v15; 
  __int64 v16; 
  INT64 v17; 
  unsigned int v18; 
  _UNICODE_STRING *v19; 
  UINT64 v20; 
  LIST_ENTRY DelayedDeref; 
  v6 = *(_WORD *)(a1 + 2);
  v8 = a4;
  DelayedDeref.Blink = &DelayedDeref;
  DelayedDeref.Flink = &DelayedDeref;
  v10 = (volatile INT64 *)(a2 + 1672);
  KcbAtLayerHeight = CmpGetKcbAtLayerHeight(a1, v6);
  ExAcquirePushLockExclusiveEx(a2 + 1672, 0i64);
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(1ui64);
  for( i = *(_QWORD *)(a2 + 1584); i; i = *(_QWORD *)i )
  {
    v14 = *(_QWORD *)(i + 32);
    if( (*(_DWORD *)(v14 + 8) & 0x7FE00000u) > (*(_DWORD *)(KcbAtLayerHeight + 8) & 0x7FE00000u) )
      break;
    if( (v8 & *(_DWORD *)(i + 48) & 0x3FFFFFFF) != 0
      && ((*(_DWORD *)(i + 48) & 0x40000000) != 0 || v14 == KcbAtLayerHeight) )
    {
      v15.0 = *($F21FB2B31E9B30A96ADF077329256E82 *)(*(_QWORD *)(i + 40) + 56i64);
      if( (!a3 || *(_QWORD *)(a3 + 56) == *(_QWORD *)&v15.0)
        && (!*(_QWORD *)&v15.0 || (unsigned int)CmpTransIsTransActive(v15)) )
      {
        v16 = *(_QWORD *)(i + 32);
        v17 = KcbAtLayerHeight;
        v18 = (*(_DWORD *)(v16 + 8) >> 21) & 0x3FF;
        if( ((*(_DWORD *)(KcbAtLayerHeight + 8) >> 21) & 0x3FFu) > v18 )
        {
          do
            v17 = *(_QWORD *)(v17 + 72);
          while( ((*(_DWORD *)(v17 + 8) >> 21) & 0x3FFu) > v18 );
        }
        if( v17 == v16 && CmpNotifyTriggerCheck(i, a1, a3) )
          CmpPostNotify((_CM_NOTIFY_BLOCK *)i, v19, v20, 268i64, 0, &DelayedDeref, ExternalDeferredPostAsync);
      }
    }
  }
  __writecr8(CurrentIrql);
  if( (_InterlockedExchangeAdd64(v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v10);
  KeAbPostRelease((PVOID)v10);
  CmpDelayedDerefKeys(&DelayedDeref);
}

Referenced by: