ExRegisterCallback

PVOID __stdcall ExRegisterCallback(
        PCALLBACK_OBJECT CallbackObject,
        PCALLBACK_FUNCTION CallbackFunction,
        PVOID CallbackContext){
  VOID **PoolWithTag; 
  VOID **v7; 
  char v8; 
  unsigned __int64 v9; 
  PCALLBACK_OBJECT *v10; 

  ObfReferenceObjectWithTag(CallbackObject, 0x746C6644ui64);
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x30ui64, 1699889731i64);
  v7 = PoolWithTag;
  if( PoolWithTag )
  {
    *((_DWORD *)PoolWithTag + 10) = 0;
    PoolWithTag[2] = CallbackObject;
    v8 = 0;
    PoolWithTag[3] = CallbackFunction;
    PoolWithTag[4] = CallbackContext;
    *((_BYTE *)PoolWithTag + 44) = 0;
    v9 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)CallbackObject + 1);
    if( *((_BYTE *)CallbackObject + 32)
      || *((PCALLBACK_OBJECT *)CallbackObject + 2) == (PCALLBACK_OBJECT)((char *)CallbackObject + 16) )
    {
      v8 = 1;
      v10 = (PCALLBACK_OBJECT *)*((_QWORD *)CallbackObject + 3);
      if( *v10 != (PCALLBACK_OBJECT)((char *)CallbackObject + 16) )
        __fastfail(3u);
      *v7 = (char *)CallbackObject + 16;
      v7[1] = v10;
      *v10 = (PCALLBACK_OBJECT)v7;
      *((_QWORD *)CallbackObject + 3) = v7;
    }
    KxReleaseSpinLock((UINT64 *)CallbackObject + 1);
    __writecr8(v9);
    if( !v8 )
    {
      ExFreePoolWithTag(v7, 0);
      ObfDereferenceObjectWithTag(CallbackObject, 0x746C6644ui64);
      return 0i64;
    }
    return v7;
  }
  else
  {
    ObfDereferenceObjectWithTag(CallbackObject, 0x746C6644ui64);
    return 0i64;
  }
}

Referenced by: