ExpNtUpdateWnfStateData

__int64 __fastcall ExpNtUpdateWnfStateData(
        INT64 *a1,
        INT64 a2,
        unsigned int a3,
        __int128 *a4,
        __int64 a5,
        INT64 a6,
        INT64 a7,
        int a8){
  _ETHREAD *CurrentThread; 
  CHAR v9; 
  unsigned __int64 v10; 
  int NameInstance; 
  unsigned __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  INT64 v15; 
  _ETHREAD *v16; 
  _EPROCESS *v17; 
  _WNF_STATE_NAME_STRUCT v18; 
  _WNF_SCOPE_INSTANCE *v19; 
  int v20; 
  unsigned int v21; 
  int v22; 
  _WNF_STATE_NAME_REGISTRATION *v24; 
  int v25; 
  UINT64 *v26; 
  _BYTE *v27; 
  _BYTE *v28; 
  __int64 v29; 
  INT64 v30; 
  INT64 v31; 
  PSID Sid; 
  INT64 v33; 
  int v34; 
  _DWORD Privileges[3]; 
  int v36; 
  _WNF_STATE_NAME_STRUCT InternalStateName; 
  PVOID P; 
  int v39; 
  PSID v40; 
  UINT8 AccessGranted[8]; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  VOID *Data; 
  _EPROCESS *Process; 
  INT64 CapturedScopeData[2]; 
  INT64 v46; 
  INT64 v47; 
  __int128 v48; 
  Privileges[0] = a3;
  Data = (VOID *)a2;
  InternalStateName = 0i64;
  v48 = 0i64;
  v40 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  P = 0i64;
  ScopeInstance = 0i64;
  *(_QWORD *)&Privileges[1] = 0i64;
  LODWORD(v10) = 0;
  *(_OWORD *)CapturedScopeData = 0i64;
  *(_QWORD *)AccessGranted = a4;
  NameInstance = ExpCaptureWnfStateName((const _WNF_STATE_NAME *)a1, &InternalStateName, v9);
  if( NameInstance < 0 )
    goto LABEL_26;
  v39 = (*(unsigned __int64 *)&InternalStateName >> 4) & 3;
  v10 = (*(unsigned __int64 *)&InternalStateName >> 6) & 0xF;
  v34 = (*(unsigned __int64 *)&InternalStateName >> 6) & 0xF;
  if( v9 )
  {
    if( (_DWORD)v13 && (v14 + v13 > 0x7FFFFFFF0000i64 || v14 + v13 < v14) )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( v12 )
    {
      if( v12 >= 0x7FFFFFFF0000i64 )
        v12 = 0x7FFFFFFF0000i64;
      v48 = *(_OWORD *)v12;
      *(_QWORD *)AccessGranted = &v48;
    }
  }
  NameInstance = ExpWnfCaptureScopeInstanceId(
                   (*(unsigned __int64 *)&InternalStateName >> 6) & 0xF,
                   (UINT64 *)a5,
                   v9,
                   &v40,
                   (INT64)CapturedScopeData);
  if( NameInstance < 0 )
    goto LABEL_26;
  if( v9 )
  {
    v36 = 0;
    if( a5 )
    {
      NameInstance = ExpWnfCheckCrossScopeAccess(InternalStateName);
      if( NameInstance < 0 )
        goto LABEL_26;
    }
  }
  else
  {
    v36 = 1;
  }
  if( v9 )
  {
    v16 = (_ETHREAD *)KeGetCurrentThread();
    v17 = (_EPROCESS *)*((_QWORD *)v16 + 23);
    Process = v17;
    LODWORD(v10) = v34;
    if( v34 == 3 && (!v40 || v17 == *(_EPROCESS **)v40) )
      goto LABEL_44;
  }
  else
  {
    v16 = 0i64;
    v17 = (_EPROCESS *)PsInitialSystemProcess;
    Process = (_EPROCESS *)PsInitialSystemProcess;
  }
  if( (_DWORD)v10 == 5 && a8 )
  {
    if( (_DWORD)a7 )
    {
LABEL_44:
      NameInstance = -1073741811;
      goto LABEL_26;
    }
    v46 = *(_QWORD *)&InternalStateName ^ 0x41C64E6DA3BC0074i64;
    LODWORD(v33) = Privileges[0];
    NameInstance = ExpCrossVmWnfPush(v15, 1ui64, (INT64)&v46, 0xFFFFFFFFui64, (INT64)Data, v33);
    if( NameInstance != -1073741822 )
      goto LABEL_26;
  }
  NameInstance = ExpWnfResolveScopeInstance(
                   (struct _EX_RUNDOWN_REF **)&ScopeInstance,
                   (__int64)v17,
                   (__int64)v16,
                   v10,
                   v40);
  if( NameInstance < 0 )
    goto LABEL_26;
  v18 = InternalStateName;
  v19 = ScopeInstance;
  v20 = ExpWnfLookupNameInstance(ScopeInstance, InternalStateName, (_WNF_NAME_INSTANCE **)&Privileges[1]);
  NameInstance = v20;
  if( v20 != -1073741772 || v39 == 3 )
  {
    if( v20 < 0 )
      goto LABEL_26;
    v21 = Privileges[0];
    ExpWnfValidatePubSubPreconditions(
      (UNICODE_STRING *)2,
      (SECURITY_SUBJECT_CONTEXT *)(*(_QWORD *)&Privileges[1] + 56i64),
      (PRIVILEGE_SET *)Privileges[0],
      AccessGranted[0]);
    NameInstance = v22;
    if( v22 < 0 )
      goto LABEL_26;
  }
  else
  {
    NameInstance = ExpWnfLookupPermanentName(v18, (_WNF_STATE_NAME_REGISTRATION **)&P);
    if( NameInstance < 0 )
      goto LABEL_26;
    v24 = (_WNF_STATE_NAME_REGISTRATION *)P;
    ExpWnfValidatePubSubPreconditions(
      (UNICODE_STRING *)2,
      (SECURITY_SUBJECT_CONTEXT *)P,
      (PRIVILEGE_SET *)Privileges[0],
      AccessGranted[0]);
    NameInstance = v25;
    if( v25 < 0 )
      goto LABEL_26;
    NameInstance = ExpWnfCreateNameInstance(v19, v18, v24, Process, (_WNF_NAME_INSTANCE **)&Privileges[1]);
    ExFreePoolWithTag(v24, 0x20666E57u);
    P = 0i64;
    if( NameInstance < 0 )
      goto LABEL_26;
    v21 = Privileges[0];
  }
  LODWORD(Sid) = a7;
  NameInstance = ExpWnfWriteStateData(*(_WNF_NAME_INSTANCE **)&Privileges[1], Data, v21, (unsigned int)a6, (UINT64)Sid);
  if( NameInstance >= 0 )
  {
    if( (_DWORD)v10 == 5 )
    {
      v47 = *(_QWORD *)&InternalStateName ^ 0x41C64E6DA3BC0074i64;
      v26 = (UINT64 *)(*(_QWORD *)&Privileges[1] + 80i64);
      LODWORD(v27) = KeAbPreAcquire((PVOID)(*(_QWORD *)&Privileges[1] + 80i64), 0i64, 0i64);
      v28 = v27;
      if( _InterlockedCompareExchange64((volatile signed __int64 *)v26, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx(v26, v27, v26);
      if( v28 )
        v28[26] |= 1u;
      v29 = 0i64;
      if( *(_QWORD *)(*(_QWORD *)&Privileges[1] + 88i64) != 1i64 )
        v29 = *(_QWORD *)(*(_QWORD *)&Privileges[1] + 88i64);
      if( v29 )
      {
        v30 = v29 + 16;
        v31 = *(unsigned int *)(v29 + 8);
      }
      else
      {
        v30 = 0i64;
        v31 = 0i64;
      }
      LODWORD(v33) = v31;
      ExpCrossVmWnfPush(v31, 0i64, (INT64)&v47, *(unsigned int *)(*(_QWORD *)&Privileges[1] + 96i64), v30, v33);
      if( _InterlockedCompareExchange64((volatile signed __int64 *)v26, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)v26);
      KeAbPostRelease(v26);
      LODWORD(v10) = v34;
    }
    ExpWnfNotifyNameSubscribers(*(INT64 *)&Privileges[1], 1ui64, 1i64, v9 != 0);
    NameInstance = 0;
  }
LABEL_26:
  if( *(_QWORD *)&Privileges[1] )
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)(*(_QWORD *)&Privileges[1] + 8i64));
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( P )
    ExFreePoolWithTag(P, 0x20666E57u);
  KeLeaveCriticalRegion();
  ExpWnfReleaseCapturedScopeInstanceId(v10, (PVOID *)CapturedScopeData, v9);
  return(unsigned int)NameInstance;
}

Referenced by: