FsRtlpOplockSendModernAppTermination
VOID __stdcall FsRtlpOplockSendModernAppTermination(_NONOPAQUE_OPLOCK *Oplock, _RH_OP_CONTEXT *RHOpContext){
char v2;
unsigned int v4;
VOID **PoolWithTag;
UINT64 *v6;
_LIST_ENTRY *p_RHBreakQueue;
unsigned int v8;
_LIST_ENTRY *i;
__int64 v10;
_EPROCESS *ExclusiveOplockOwner;
int v12;
int UniqueProcessId;
v2 = 0;
if( RHOpContext || (ExclusiveOplockOwner = Oplock->ExclusiveOplockOwner) == 0i64 )
{
v4 = 4096;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 1953649478i64);
v6 = (UINT64 *)PoolWithTag;
if( PoolWithTag )
{
memset(PoolWithTag, 0i64, 0x1000u);
p_RHBreakQueue = &Oplock->RHBreakQueue;
v2 = 1;
v8 = 1;
for( i = p_RHBreakQueue->Flink; ; i = i->Flink )
{
if( i == p_RHBreakQueue )
{
*(_DWORD *)v6 = v8 - 1;
goto LABEL_8;
}
if( v8 >= 0x400 )
break;
v10 = v8++;
*((_DWORD *)v6 + v10) = i[2].Flink[68].Flink;
}
memset((char *)v6 + 4, 0i64, 0xFFCu);
*(_DWORD *)v6 = -1;
}
else
{
v12 = -1;
v6 = (UINT64 *)&v12;
UniqueProcessId = 0;
}
v4 = 4;
}
else
{
v12 = 1;
v6 = (UINT64 *)&v12;
v4 = 8;
UniqueProcessId = (int)ExclusiveOplockOwner->UniqueProcessId;
}
LABEL_8:
FsRtlSendModernAppTermination(v6, v4, FsrlOplockBreak);
if( v2 )
ExFreePoolWithTag(v6, 0);
}Referenced by:
FsRtlpOplockBreakByCacheFlags
FsRtlpOplockBreakNotify
FsRtlpOplockBreakToII
FsRtlpOplockBreakToNone
FsRtlpRemoveAndBreakRHIrp
FsRtlpRemoveAndCompleteRHIrp