FsRtlCancelNotify

VOID __stdcall FsRtlCancelNotify(_DEVICE_OBJECT *DeviceObject, _IRP *ThisIrp){
  _QWORD *Information; 
  _LIST_ENTRY *Blink; 
  _ETHREAD *CurrentThread; 
  __int64 v6; 
  _ETHREAD *v7; 
  _LIST_ENTRY *p_ListEntry; 
  _LIST_ENTRY *Flink; 
  _IRP *v10; 
  _MDL *MdlAddress; 
  _IRP *MappedSystemVa; 
  VOID *PoolWithTag; 
  ULONG_PTR v14; 
  char *v15; 
  __int64 v16; 
  int v17; 
  __int16 v18; 
  UINT64 BugCheckOnFailure; 
  UINT64 Priority; 
  _SECURITY_SUBJECT_CONTEXT *SubjectContext; 
  __int64 v23; 
  _QWORD *v24; 
  char *P; 

  SubjectContext = 0i64;
  Information = (_QWORD *)ThisIrp->IoStatus.Information;
  v24 = Information;
  P = (char *)Information;
  _InterlockedExchange64((volatile __int64 *)&ThisIrp->CancelRoutine, 0i64);
  ThisIrp->IoStatus.Information = 0i64;
  KeReleaseQueuedSpinLock(LockQueueIoCancelLock, ThisIrp->CancelIrql);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v6 = *Information;
  v7 = (_ETHREAD *)KeGetCurrentThread();
  if( v7 != *(_ETHREAD **)(*Information + 56i64) )
  {
    ExAcquireFastMutexUnsafe((PFAST_MUTEX)v6);
    *(_QWORD *)(v6 + 56) = v7;
  }
  ++*(_DWORD *)(v6 + 64);
  p_ListEntry = &ThisIrp->Tail.ListEntry;
  Flink = ThisIrp->Tail.ListEntry.Flink;
  if( Flink )
  {
    Blink = ThisIrp->Tail.ListEntry.Blink;
    if( Flink->Blink != p_ListEntry || Blink->Flink != p_ListEntry )
      __fastfail(3u);
    Blink->Flink = Flink;
    Flink->Blink = Blink;
  }
  ThisIrp->Tail.CurrentStackLocation->Control |= 1u;
  v10 = (_IRP *)Information[11];
  if( v10 && !Information[10] )
  {
    if( (MdlAddress = ThisIrp->MdlAddress) != 0i64
      && ((MdlAddress->MdlFlags & 5) == 0 ? (LODWORD(Priority) = 1073741840,
                                             LODWORD(BugCheckOnFailure) = 0,
                                             MappedSystemVa = (_IRP *)MmMapLockedPagesSpecifyCache(
                                                                        MdlAddress,
                                                                        0,
                                                                        MmCached,
                                                                        0i64,
                                                                        BugCheckOnFailure,
                                                                        Priority),
                                             v10 = (_IRP *)Information[11]) : (MappedSystemVa = (_IRP *)MdlAddress->MappedSystemVa),
          MappedSystemVa == v10)
      || v10 == ThisIrp->AssociatedIrp.MasterIrp )
    {
      PoolWithTag = 0i64;
      v14 = 0;
      v15 = (char *)*((_QWORD *)P + 6);
      if( v15 == P + 48 )
      {
        if( *((_DWORD *)P + 24) >= *((_DWORD *)P + 26) )
          v14 = *((_DWORD *)P + 24);
      }
      else
      {
        v23 = *((_QWORD *)v15 + 2);
        LODWORD(Blink) = *(_DWORD *)(v23 + 8);
        if( (unsigned int)Blink >= *((_DWORD *)P + 26) )
        {
          v14 = *(_DWORD *)(v23 + 8);
          if( *((_QWORD *)v15 - 18) )
          {
            PoolWithTag = (VOID *)*((_QWORD *)v15 - 18);
          }
          else
          {
            v16 = *((_QWORD *)v15 - 20);
            if( v16 )
            {
              if( (*(_BYTE *)(v16 + 10) & 5) != 0 )
              {
                PoolWithTag = *(VOID **)(v16 + 24);
              }
              else
              {
                LODWORD(Priority) = 1073741840;
                LODWORD(BugCheckOnFailure) = 0;
                PoolWithTag = MmMapLockedPagesSpecifyCache((_MDL *)v16, 0, MmCached, 0i64, BugCheckOnFailure, Priority);
                v14 = *(_DWORD *)(v23 + 8);
              }
            }
          }
          if( v14 > *((_DWORD *)P + 24) )
            v14 = *((_DWORD *)P + 24);
        }
      }
      if( v14 )
      {
        if( !PoolWithTag )
        {
          v17 = PsChargeProcessPoolQuota(*((PEPROCESS *)P + 15), PagedPool, v14);
          if( v17 < 0 )
            RtlRaiseStatus(v17);
          PoolWithTag = ExAllocatePoolWithTag(0x11ui64, v14, 1316115270i64);
          *((_QWORD *)P + 10) = PoolWithTag;
        }
        memmove(PoolWithTag, *((const VOID **)P + 11), *((_DWORD *)P + 26));
        *((_DWORD *)P + 25) = v14;
        *((_QWORD *)P + 11) = PoolWithTag;
        v18 = *((_WORD *)v24 + 36);
      }
      else
      {
        *((_WORD *)P + 36) |= 2u;
        v18 = *((_WORD *)P + 36);
      }
      if( (v18 & 2) != 0 )
      {
        *((_QWORD *)P + 11) = 0i64;
        *((_QWORD *)P + 10) = 0i64;
        *((_QWORD *)P + 13) = 0i64;
        *((_DWORD *)P + 25) = 0;
      }
    }
  }
  ThisIrp->IoStatus.Status = -1073741536;
  LOBYTE(Blink) = 1;
  IofCompleteRequest(ThisIrp, (_CCHAR)Blink);
  _InterlockedDecrement((volatile signed __int32 *)P + 28);
  if( !*((_DWORD *)P + 28) )
  {
    if( *((_QWORD *)P + 10) )
    {
      PsReturnProcessPagedPoolQuota(*((_QWORD *)P + 15), *((_DWORD *)P + 25));
      ExFreePoolWithTag(*((PVOID *)P + 10), 0);
    }
    if( (P[72] & 0x40) != 0 || *((_QWORD *)P + 17) )
      SubjectContext = (_SECURITY_SUBJECT_CONTEXT *)*((_QWORD *)P + 3);
    ExFreePoolWithTag(P, 0);
  }
  if( (*(_DWORD *)(v6 + 64))-- == 1 )
  {
    *(_QWORD *)(v6 + 56) = 0i64;
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)v6);
  }
  if( SubjectContext )
  {
    SeReleaseSubjectContext(SubjectContext);
    ExFreePoolWithTag(SubjectContext, 0);
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
}

Referenced by: