CmUnRegisterCallback

NTSTATUS __stdcall CmUnRegisterCallback(LARGE_INTEGER Cookie){
  NTSTATUS v2; 
  _ETHREAD *CurrentThread; 
  char *v4; 
  char *v5; 
  int v6; 
  _ETHREAD *v7; 
  _QWORD *v8; 
  void **v9; 
  _QWORD *v10; 
  void **v11; 
  char v12; 
  _ETHREAD *v13; 
  _QWORD *v14; 
  _QWORD *v15; 
  _QWORD *v16; 
  _QWORD *v17; 
  _QWORD *v18; 
  __int64 v19; 
  _QWORD *v20; 
  __int64 v21; 
  _QWORD *v22; 
  _QWORD *v23; 
  __int64 v24; 
  __int64 v25; 
  PADAPTER_OBJECT *v26; 
  _ETHREAD *v27; 
  __int64 v28; 
  _QWORD *v29; 
  _QWORD *v30; 
  void *v31; 
  void *v32; 
  _QWORD *v34; 
  LIST_ENTRY *ListIterator[4]; 
  __int128 v36; 
  __int128 v37; 
  __int64 v38; 
  int CompareAddress; 
  int v40; 

  v2 = -1073741811;
  v40 = -1073741811;
  v37 = 0i64;
  v38 = 0i64;
  v36 = 0i64;
  ListIterator[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 251, 0i64);
  do
  {
    do
    {
      LODWORD(v4) = CmListGetNextElement((LIST_ENTRY *)&CmpDummyThreadEvent + 126, ListIterator, 0i64);
      v5 = v4;
      ListIterator[1] = (LIST_ENTRY *)v4;
      if( !v4 )
        goto LABEL_12;
    }
    while( *((_QWORD *)v4 + 3) != Cookie.QuadPart );
    v6 = *((_DWORD *)v4 + 4);
    CompareAddress = v6;
    if( !v6 )
    {
      v10 = *(_QWORD **)v5;
      v11 = (void **)*((_QWORD *)v5 + 1);
      if( *(char **)(*(_QWORD *)v5 + 8i64) == v5 && *v11 == v5 )
      {
        *v11 = v10;
        v10[1] = v11;
        ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2008, 0);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        v2 = 0;
        v40 = 0;
        goto LABEL_17;
      }
LABEL_33:
      __fastfail(3u);
    }
  }
  while( (v6 & 0x80000000) != 0 );
  _InterlockedOr((volatile signed __int32 *)v5 + 4, 0x80000000);
  ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2008, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  while( 1 )
  {
    CompareAddress = *((_DWORD *)v5 + 4);
    if( CompareAddress == 0x80000000 )
      break;
    ExBlockOnAddressPushLock((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 255, v5 + 16, &CompareAddress, 4ui64, 0i64);
  }
  v7 = (_ETHREAD *)KeGetCurrentThread();
  --v7->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 251, 0i64);
  v8 = *(_QWORD **)v5;
  v9 = (void **)*((_QWORD *)v5 + 1);
  if( *(char **)(*(_QWORD *)v5 + 8i64) != v5 || *v9 != v5 )
    goto LABEL_33;
  *v9 = v8;
  v8[1] = v9;
  ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2008, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  v2 = 0;
  v40 = 0;
LABEL_12:
  if( v2 < 0 )
  {
    ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2008, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return v2;
  }
LABEL_17:
  *((_QWORD *)&v36 + 1) = &v36;
  *(_QWORD *)&v36 = &v36;
  v12 = 0;
  v13 = (_ETHREAD *)KeGetCurrentThread();
  --v13->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 254, 0i64);
  v14 = v5 + 64;
  v15 = (_QWORD *)*((_QWORD *)v5 + 8);
  v16 = v15;
  ListIterator[3] = (LIST_ENTRY *)(v5 + 64);
  while( 1 )
  {
    v34 = v15;
    if( v16 == v14 )
      break;
    v17 = (_QWORD *)*v15;
    v18 = v15 - 2;
    if( ObReferenceObjectSafe(v15[4]) )
    {
      v19 = v18[2];
      v20 = (_QWORD *)v18[3];
      if( *(_QWORD **)(v19 + 8) != v18 + 2 )
        goto LABEL_33;
      if( (_QWORD *)*v20 != v18 + 2 )
        goto LABEL_33;
      *v20 = v19;
      *(_QWORD *)(v19 + 8) = v20;
      v21 = *v18;
      v22 = (_QWORD *)v18[1];
      if( *(_QWORD **)(*v18 + 8i64) != v18 )
        goto LABEL_33;
      if( (_QWORD *)*v22 != v18 )
        goto LABEL_33;
      *v22 = v21;
      *(_QWORD *)(v21 + 8) = v22;
      v23 = (_QWORD *)*((_QWORD *)&v36 + 1);
      if( **((__int128 ***)&v36 + 1) != &v36 )
        goto LABEL_33;
      *v16 = &v36;
      v16[1] = v23;
      *v23 = v16;
      *((_QWORD *)&v36 + 1) = v16;
    }
    else
    {
      v12 = 1;
    }
    v15 = v17;
    v16 = v17;
    v14 = v5 + 64;
  }
  ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2032, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  while( 1 )
  {
    v24 = v36;
    if( (__int128 *)v36 == &v36 )
      break;
    v25 = *(_QWORD *)v36;
    if( *(__int128 **)(v36 + 8) != &v36 || *(_QWORD *)(v25 + 8) != (_QWORD)v36 )
      goto LABEL_33;
    *(_QWORD *)&v36 = *(_QWORD *)v36;
    *(_QWORD *)(v25 + 8) = &v36;
    v26 = (PADAPTER_OBJECT *)(v24 - 16);
    ListIterator[2] = (LIST_ENTRY *)(v24 - 16);
    v37 = *(_OWORD *)(v24 - 16 + 48);
    (*((void(__fastcall **)(_QWORD, __int64, __int128 *))v5 + 5))(*((_QWORD *)v5 + 4), 40i64, &v37);
    HalPutDmaAdapter(v26[6]);
    ExFreePoolWithTag(v26, 0x63634D43u);
  }
  while( v12 )
  {
    v27 = (_ETHREAD *)KeGetCurrentThread();
    --v27->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 254, 0i64);
    v34 = (_QWORD *)*((_QWORD *)v5 + 8);
    v28 = (__int64)v34;
    ExReleasePushLockEx((ULONG_PTR)&CmpDummyThreadEvent + 2032, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( (_QWORD *)v28 == v14 )
      v12 = 0;
    else
      ExBlockOnAddressPushLock((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 255, v5 + 64, &v34, 8ui64, 0i64);
  }
  if( _InterlockedExchangeAdd(&dword_140C5083C, 0xFFFFFFFF) == 1 )
  {
    RtlpInterlockedFlushSList();
    v30 = v29;
    while( v30 )
    {
      v31 = v30;
      v30 = (_QWORD *)*v30;
      ExFreePoolWithTag(v31, 0);
    }
  }
  v32 = (void *)*((_QWORD *)v5 + 7);
  if( v32 )
    ExFreePoolWithTag(v32, 0);
  ExFreePoolWithTag(v5, 0);
  return v2;
}

Referenced by: