PspSetCreateProcessNotifyRoutine

NTSTATUS __stdcall PspSetCreateProcessNotifyRoutine(VOID *NotifyRoutine, UINT64 Flags){
  INT64 *v2; 
  int v3; 
  VOID *v5; 
  VOID *v6; 
  _EX_RUNDOWN_REF *v7; 
  __int64 v8; 
  _ETHREAD *CurrentThread; 
  __int64 v10; 
  _EX_RUNDOWN_REF *v11; 
  _EX_RUNDOWN_REF *v12; 
  volatile signed __int32 *v13; 
  VOID *v15; 
  VOID *v16; 

  v2 = (INT64 *)(unsigned int)Flags;
  v3 = Flags & 2;
  if( (Flags & 1) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v10 = 0i64;
    while( 1 )
    {
      v11 = ExReferenceCallBackBlock((INT64 *)&stru_140CEC120.Ptr + v10);
      v12 = v11;
      if( v11 )
      {
        LODWORD(v2) = (unsigned int)v2 & 0xFFFFFFFE;
        if( v11[1].Ptr == NotifyRoutine
          && LODWORD(v11[2].Count) == (_DWORD)v2
          && ExCompareExchangeCallBack(
               (_EX_CALLBACK *)&stru_140CEC120.Ptr + 2 * v10,
               0i64,
               (_EX_CALLBACK_ROUTINE_BLOCK *)v11) )
        {
          v13 = &PspCreateProcessNotifyRoutineCount;
          if( v3 )
            v13 = &PspCreateProcessNotifyRoutineExCount;
          _InterlockedDecrement(v13);
          ExDereferenceCallBackBlock((_EX_CALLBACK *)&stru_140CEC120.Ptr + 2 * v10, v12);
          KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
          ExWaitForRundownProtectionRelease(v12);
          ExFreePoolWithTag(v12, 0);
          return 0;
        }
        ExDereferenceCallBackBlock((_EX_CALLBACK *)&stru_140CEC120.Ptr + 2 * v10, v12);
      }
      v10 = (unsigned int)(v10 + 1);
      if( (unsigned int)v10 >= 0x40 )
      {
        KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
        return -1073741702;
      }
    }
  }
  if( !MmVerifyCallbackFunctionCheckFlags(NotifyRoutine) )
    return -1073741790;
  v7 = (_EX_RUNDOWN_REF *)ExAllocateCallBack((INT64)NotifyRoutine, v2, v5, v6, v15, v16);
  if( !v7 )
    return -1073741670;
  v8 = 0i64;
  while( !ExCompareExchangeCallBack((_EX_CALLBACK *)&stru_140CEC120.Ptr + 2 * v8, v7, 0i64) )
  {
    v8 = (unsigned int)(v8 + 1);
    if( (unsigned int)v8 >= 0x40 )
    {
      ExFreePoolWithTag(v7, 0);
      return -1073741811;
    }
  }
  if( v3 )
  {
    _InterlockedIncrement(&PspCreateProcessNotifyRoutineExCount);
    if( (PspNotifyEnableMask & 4) == 0 )
      _interlockedbittestandset(&PspNotifyEnableMask, 2u);
  }
  else
  {
    _InterlockedIncrement(&PspCreateProcessNotifyRoutineCount);
    if( (PspNotifyEnableMask & 2) == 0 )
      _interlockedbittestandset(&PspNotifyEnableMask, 1u);
  }
  return 0;
}

Referenced by: