PsInvokeWin32Callout

INT64 __fastcall PsInvokeWin32Callout(INT64 a1, VOID *a2, INT64 a3, UINT64 *a4){
  UINT64 *v4; 
  __int64 v5; 
  union RTL_RUN_ONCE *Win32Callouts; 
  struct EX_RUNDOWN_REF *v8; 
  EX_RUNDOWN_REF *v9; 
  NTSTATUS v10; 
  int v12; 
  __int64 v13; 
  int SessionId; 
  _DWORD *v15; 
  union RTL_RUN_ONCE *v16; 
  UINT64 *v17; 
  INT64 CallBackStatus; 
  LODWORD(CallBackStatus) = 0;
  v4 = a4;
  v5 = (int)a1;
  if( !(_DWORD)a3 )
  {
    Win32Callouts = MmSessionGetWin32Callouts();
    v8 = ExReferenceCallBackBlock((INT64 *)Win32Callouts);
    v9 = v8;
    if( v8 )
    {
      v10 = ((__int64(__fastcall *)(unsigned __int64, __int64, VOID *))v8[1].Count)(v8[2].Count, v5, a2);
      ExDereferenceCallBackBlock((INT64 *)Win32Callouts, v9);
      return(unsigned int)v10;
    }
    return(unsigned int)-1073741811;
  }
  v12 = a3 - 1;
  if( v12 )
  {
    if( v12 != 1 )
      return(unsigned int)-1073741811;
    v17 = 0i64;
  }
  else
  {
    v13 = *((_QWORD *)KeGetCurrentThread() + 23);
    if( (*(_DWORD *)(v13 + 1124) & 0x10000) != 0 )
    {
      SessionId = MmGetSessionId(v13);
      if( *v15 == SessionId )
      {
        v16 = MmSessionGetWin32Callouts();
        return(unsigned int)ExCallCallBack((signed __int64 *)v16, v5, (__int64)a2);
      }
    }
    v17 = v4;
  }
  v10 = ExCallSessionCallBack(v17, (PVOID)v5, a2, &CallBackStatus);
  if( v10 >= 0 )
    return(unsigned int)CallBackStatus;
  return(unsigned int)v10;
}

Referenced by: