NtSetWnfProcessNotificationEvent

INT64 __fastcall NtSetWnfProcessNotificationEvent(VOID *NotificationEvent){
  _ETHREAD *CurrentThread; 
  __int64 v3; 
  _WNF_PROCESS_CONTEXT *v4; 
  int v5; 
  _WNF_PROCESS_CONTEXT *ProcessContext; 
  PVOID Object; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v3 = *((_QWORD *)KeGetCurrentThread() + 23);
  ProcessContext = *(_WNF_PROCESS_CONTEXT **)(v3 + 2152);
  v4 = ProcessContext;
  if( !ProcessContext )
  {
    v5 = ExpWnfCreateProcessContext((_EPROCESS *)v3, &ProcessContext);
    if( v5 < 0 )
      goto LABEL_5;
    v4 = ProcessContext;
  }
  Object = 0i64;
  v5 = ObReferenceObjectByHandle(NotificationEvent, 2u, (POBJECT_TYPE)ExEventObjectType, 1, &Object, 0i64);
  if( v5 >= 0 )
  {
    if( _InterlockedCompareExchange64((volatile signed __int64 *)&v4->NotificationEvent, (signed __int64)Object, 0i64) )
    {
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      v5 = -1073740008;
    }
    else
    {
      v5 = 0;
    }
  }
LABEL_5:
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v5;
}

Referenced by: