NtUnsubscribeWnfStateChange

NTSTATUS __stdcall NtUnsubscribeWnfStateChange(_WNF_STATE_NAME *StateName){
  _ETHREAD *CurrentThread; 
  __int64 v2; 
  _WNF_PROCESS_CONTEXT *v3; 
  NTSTATUS v5; 
  _WNF_STATE_NAME_STRUCT InternalStateName; 
  PVOID P; 
  P = 0i64;
  InternalStateName = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v5 = ExpCaptureWnfStateName(StateName, &InternalStateName, *((_BYTE *)KeGetCurrentThread() + 562));
  if( v5 >= 0 )
  {
    v2 = *((_QWORD *)KeGetCurrentThread() + 23);
    v3 = *(_WNF_PROCESS_CONTEXT **)(v2 + 2152);
    if( v3 )
    {
      v5 = ExpWnfAcquireSubscriptionByName(InternalStateName, v3, (_WNF_SUBSCRIPTION **)&P);
      if( v5 >= 0 )
      {
        ExpWnfDeleteSubscription(P, (_EPROCESS *)v2);
        v5 = 0;
      }
    }
    else
    {
      v5 = -1073741772;
    }
  }
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v5;
}

Referenced by: