ExpWnfSubscribeWnfStateChange

__int64 __fastcall ExpWnfSubscribeWnfStateChange(
        UINT64 *a1,
        __int64 a2,
        const _WNF_STATE_NAME *a3,
        int a4,
        UINT64 a5,
        VOID *a6,
        int a7,
        CHAR ProbeMode){
  unsigned int v8; 
  int v9; 
  char v10; 
  __int64 bf_0; 
  unsigned __int64 v12; 
  int v13; 
  _EPROCESS *v14; 
  NTSTATUS v15; 
  _EPROCESS *v16; 
  _WNF_NAME_INSTANCE *v17; 
  int v18; 
  int v19; 
  UINT64 v20; 
  UINT64 v22; 
  _WNF_NAME_INSTANCE *NameInstance; 
  __int64 v24; 
  VOID **StateNameRegistration; 
  _EPROCESS *Process; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  int v28; 
  _WNF_STATE_NAME_STRUCT StateName; 
  _WNF_SUBSCRIPTION *Subscription; 

  StateName._bf_0 = 0i64;
  LODWORD(v24) = 0;
  StateNameRegistration = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  Subscription = 0i64;
  v8 = 0;
  v9 = ExpCaptureWnfStateName(a3, &StateName, ProbeMode);
  v28 = v9;
  if( v9 >= 0 )
  {
    if( (a7 & 0xFFFFFFE0) != 0 )
    {
      v9 = -1073741811;
      goto LABEL_23;
    }
    bf_0 = StateName._bf_0;
    v12 = ((unsigned __int64)StateName._bf_0 >> 4) & 3;
    if( v10 )
    {
      v13 = 0;
      v8 = (a7 & 0x11) != 0;
      if( (a7 & 0xFFFFFFEE) != 0 )
        v8 |= 2u;
    }
    else
    {
      v13 = 1;
    }
    if( v10 )
    {
      v14 = KeGetCurrentThread()->ApcState.Process;
      bf_0 = StateName._bf_0;
    }
    else
    {
      v14 = PsInitialSystemProcess;
    }
    Process = v14;
    v9 = ExpWnfResolveScopeInstance(
           &ScopeInstance,
           v14,
           0i64,
           (_WNF_DATA_SCOPE)(((unsigned __int64)StateName._bf_0 >> 6) & 0xF),
           0i64);
    if( v9 >= 0 )
    {
      v15 = ExpWnfLookupNameInstance(ScopeInstance, (_WNF_STATE_NAME_STRUCT)bf_0, &NameInstance);
      v9 = v15;
      if( v15 != -1073741772 || (_DWORD)v12 == 3 )
      {
        if( v15 < 0 )
          goto LABEL_23;
        if( !v13 )
        {
          v9 = ExpWnfCheckCallerAccess(NameInstance->StateNameInfo.SecurityDescriptor, v8);
          if( v9 < 0 )
            goto LABEL_23;
        }
        v16 = Process;
      }
      else
      {
        v9 = ExpWnfLookupPermanentName((_WNF_STATE_NAME_STRUCT)bf_0, &StateNameRegistration);
        if( v9 < 0 )
          goto LABEL_23;
        if( !v13 )
        {
          v9 = ExpWnfCheckCallerAccess(StateNameRegistration[2], v8);
          if( v9 < 0 )
            goto LABEL_23;
        }
        v16 = Process;
        v9 = ExpWnfCreateNameInstance(
               ScopeInstance,
               (_WNF_STATE_NAME_STRUCT)bf_0,
               (_WNF_STATE_NAME_REGISTRATION *)StateNameRegistration,
               Process,
               &NameInstance);
        ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
        StateNameRegistration = 0i64;
        if( v9 < 0 )
          goto LABEL_23;
      }
      LODWORD(v22) = a7;
      v17 = NameInstance;
      v9 = ExpWnfSubscribeNameInstance(
             NameInstance,
             v16,
             a5,
             a6,
             a4,
             v22,
             ProbeMode,
             a1,
             a2,
             (__int64)&Subscription,
             (__int64)&v24);
      if( v9 >= 0 )
      {
        v18 = 0;
        if( a4 != v17->CurrentChangeStamp && v17->StateData )
          v18 = 1;
        v19 = v18 | 8;
        if( NameInstance->CurrentDeliveryCount )
          v19 = v18;
        if( !(_DWORD)v24 )
        {
          if( NameInstance->DataSubscribersCount )
            v19 |= 2u;
          else
            v19 |= 4u;
        }
        v20 = a7 & (unsigned int)v19;
        if( (_DWORD)v20 )
          ExpWnfNotifySubscription(NameInstance, Subscription, v20, ProbeMode != 0);
      }
    }
  }
LABEL_23:
  if( Subscription )
    ExReleaseRundownProtection(&Subscription->RunRef);
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( StateNameRegistration )
    ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
  return(unsigned int)v9;
}

Referenced by: