ExpWnfAcquireSubscriptionNameInstance

INT64 __fastcall ExpWnfAcquireSubscriptionNameInstance(INT64 a1, INT64 a2){
  INT64 v3; 
  void *v4; 
  _BYTE *v5; 
  _BYTE *v6; 
  struct _EX_RUNDOWN_REF *v7; 
  v3 = 0i64;
  v4 = (void *)(*((_QWORD *)PsInitialSystemProcess + 269) + 80i64);
  LODWORD(v5) = KeAbPreAcquire(v4, 0i64, 0i64);
  v6 = v5;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx((UINT64 *)v4, v5, v4);
  if( v6 )
    v6[26] |= 1u;
  v7 = *(struct _EX_RUNDOWN_REF **)(a2 + 48);
  if( v7 && ExAcquireRundownProtection(v7 + 1) )
    v3 = *(_QWORD *)(a2 + 48);
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)v4);
  KeAbPostRelease(v4);
  return v3;
}

Referenced by: