PopFlushVolumes

VOID __stdcall PopFlushVolumes(UINT64 SystemState){
  int v1; 
  char v2; 
  char v3; 
  char v4; 
  char v5; 
  INT64 v6; 
  int v7; 
  POP_FLUSH_VOLUME *v8; 
  __int64 v9; 
  POP_FLUSH_VOLUME ***v10; 
  POP_FLUSH_VOLUME ***v11; 
  __int64 v12; 
  POP_FLUSH_VOLUME **v13; 
  __int64 v14; 
  POP_FLUSH_VOLUME *v15; 
  __int64 v16; 
  POP_FLUSH_VOLUME *v17; 
  __int64 v18; 
  int v19; 
  int v20; 
  POP_FLUSH_VOLUME **v21; 
  POP_FLUSH_VOLUME **v22; 
  INT64 v23; 
  PKSTART_ROUTINE StartRoutine; 
  PVOID StartContext; 
  INT64 v26; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  POP_FLUSH_VOLUME Flush; 
  __int128 v30; 
  __int64 v31; 
  VOID *KeyHandle; 
  void *ThreadHandle; 

  ThreadHandle = 0i64;
  KeyHandle = 0i64;
  v1 = SystemState;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  PopDiagTraceEventNoPayload(&POP_ETW_EVENT_FLUSHVOLUMES_START);
  v31 = 0i64;
  *(_QWORD *)&Flush.Count = &Flush;
  *(_QWORD *)Flush.List = &Flush;
  *(_OWORD *)&Flush.Wait[4] = 0i64;
  v30 = 0i64;
  KeInitializeEvent((INT64)&Flush.Wait[12], 0, 0);
  if( v1 == 6 )
  {
    v2 = 2;
  }
  else
  {
    v2 = PopFlushPolicy;
    if( byte_140C23480 )
      v2 = 3;
  }
  v3 = v2 | 0x10;
  if( v1 != 5 )
    v3 = v2;
  v4 = v31;
  if( (v3 & 4) != 0 )
    v4 = 1;
  LOBYTE(v31) = v4;
  v5 = BYTE1(v31);
  if( (v3 & 8) != 0 )
    v5 = 1;
  BYTE1(v31) = v5;
  if( (v3 & 1) != 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"\\Registry");
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v6, v23, (INT64)StartRoutine, (INT64)StartContext, v26) >= 0 )
    {
      ZwFlushKey(KeyHandle);
      ZwClose((_HANDLE)KeyHandle);
    }
  }
  v7 = 0;
  ExAcquireFastMutex((PFAST_MUTEX)((char *)&stru_140C23628 + 1368));
  v8 = (POP_FLUSH_VOLUME *)*(&stru_140C23628 + 167);
  while( v8 != (POP_FLUSH_VOLUME *)((char *)&stru_140C23628 + 1336) )
  {
    v12 = *(_QWORD *)&v8[-2].Wait[4];
    v13 = (POP_FLUSH_VOLUME **)v8;
    v8 = *(POP_FLUSH_VOLUME **)v8->List;
    v14 = *(_QWORD *)(v12 + 56);
    if( (*(_BYTE *)(v14 + 4) & 1) != 0 && (*(_DWORD *)(v12 + 52) & 0x10006) == 0 )
    {
      v9 = *(_QWORD *)(v14 + 16);
      if( !v9 || (*(_DWORD *)(v9 + 52) & 4) == 0 )
      {
        if( *(POP_FLUSH_VOLUME ***)&v8->Count != v13
          || (v10 = (POP_FLUSH_VOLUME ***)v13[1], *v10 != v13)
          || (*v10 = (POP_FLUSH_VOLUME **)v8,
              *(_QWORD *)&v8->Count = v10,
              v11 = *(POP_FLUSH_VOLUME ****)&Flush.Count,
              **(POP_FLUSH_VOLUME ***)&Flush.Count != &Flush) )
        {
LABEL_34:
          __fastfail(3u);
        }
        v13[1] = *(POP_FLUSH_VOLUME **)&Flush.Count;
        *v13 = &Flush;
        ++v7;
        *v11 = v13;
        *(_QWORD *)&Flush.Count = v13;
      }
    }
  }
  if( (v3 & 2) == 0 )
  {
    v15 = *(POP_FLUSH_VOLUME **)Flush.List;
    while( v15 != &Flush )
    {
      v16 = *(_QWORD *)&v15[-2].Wait[4];
      v17 = v15;
      v15 = *(POP_FLUSH_VOLUME **)v15->List;
      if( (*(_DWORD *)(v16 + 52) & 1) == 0 )
      {
        v18 = *(_QWORD *)(*(_QWORD *)(v16 + 56) + 16i64);
        if( !v18 || (*(_DWORD *)(v18 + 52) & 1) == 0 )
        {
          if( (v3 & 0x10) == 0
            || ((v19 = *(_DWORD *)(v16 + 48), (v19 & 0x200000) == 0) || (v19 & 0x100) != 0)
            && (!v18 || (v20 = *(_DWORD *)(v18 + 48), (v20 & 0x200000) == 0) || (v20 & 0x100) != 0) )
          {
            if( *(POP_FLUSH_VOLUME **)&v15->Count != v17 )
              goto LABEL_34;
            v21 = *(POP_FLUSH_VOLUME ***)&v17->Count;
            if( *v21 != v17 )
              goto LABEL_34;
            *v21 = v15;
            *(_QWORD *)&v15->Count = v21;
            v22 = (POP_FLUSH_VOLUME **)*(&stru_140C23628 + 168);
            if( (_UNKNOWN *)**(&stru_140C23628 + 168) != (_UNKNOWN *)((char *)&stru_140C23628 + 1336) )
              goto LABEL_34;
            *(_QWORD *)v17->List = (char *)&stru_140C23628 + 1336;
            --v7;
            *(_QWORD *)&v17->Count = v22;
            *v22 = v17;
            *(&stru_140C23628 + 168) = v17;
          }
        }
      }
    }
  }
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C23628 + 1368));
  if( v7 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    if( v7 > 8 )
      v7 = 8;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    *(_DWORD *)&Flush.Wait[4] = v7;
    while( --v7 > 0 )
    {
      if( PsCreateSystemThread(
             &ThreadHandle,
             0x1FFFFFu,
             &ObjectAttributes,
             0,
             0i64,
             (PKSTART_ROUTINE)PopFlushVolumeWorker,
             &Flush) < 0 )
      {
        ExAcquireFastMutex((PFAST_MUTEX)((char *)&stru_140C23628 + 1368));
        *(_DWORD *)&Flush.Wait[4] -= v7;
        KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C23628 + 1368));
        break;
      }
      ZwClose((_HANDLE)ThreadHandle);
    }
    PopFlushVolumeWorker(&Flush);
    KeWaitForSingleObject((UINT64)&Flush.Wait[12], 0, 0, 0, 0i64);
  }
  PopDiagTraceEventNoPayload(&POP_ETW_EVENT_FLUSHVOLUMES_STOP);
}

Referenced by: