PspAllocateAndQueryProcessNotificationChannel

VOID __fastcall PspAllocateAndQueryProcessNotificationChannel(INT64 a1, INT64 a2, INT64 a3){
  char v3; 
  INT64 v4; 
  char v5; 
  char v9; 
  int v10; 
  unsigned int v11; 
  int *v12; 
  int v13; 
  int v14; 
  unsigned __int8 v15; 
  char v16; 
  char v17; 
  __int128 SecurityDescriptor[2]; 
  __int64 v19; 
  WNF_STATE_NAME StateName; 
  struct _ACL Acl; 
  v3 = 0;
  v4 = a2 + 2464;
  v19 = 0i64;
  v5 = 0;
  v9 = 0;
  v17 = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v16 = 0;
  StateName = 0i64;
  if( !*(_QWORD *)(a2 + 2464) )
  {
    RtlCreateAcl(&Acl, 0x58u, 2u);
    RtlpAddKnownAce(&Acl, 2ui64, 0i64, 1ui64, SeWorldSid, 0);
    RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, &Acl, 0);
    ZwCreateWnfStateName();
    if( v10 < 0 )
      return;
    --*(_WORD *)(a1 + 484);
    ExAcquirePushLockExclusiveEx(a2 + 1080, 0i64);
    if( *(_QWORD *)v4 )
    {
      v17 = 1;
    }
    else
    {
      *(WNF_STATE_NAME *)v4 = StateName;
      *(_QWORD *)(a2 + 2500) = *(_QWORD *)(a3 + 36);
      v16 = 1;
    }
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 1080), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)(a2 + 1080));
    KeAbPostRelease((PVOID)(a2 + 1080));
    KeLeaveCriticalRegionThread(a1);
    v5 = v17;
    v3 = v16;
  }
  v11 = 0;
  v12 = (int *)(a3 + 8);
  *(_OWORD *)a3 = *(_OWORD *)v4;
  *(_OWORD *)(a3 + 16) = *(_OWORD *)(v4 + 16);
  *(_OWORD *)(a3 + 32) = *(_OWORD *)(v4 + 32);
  do
  {
    v13 = *v12 & 0x7FFFFFFF;
    *v12 = v13;
    if( v3 )
    {
      v14 = *(_DWORD *)(a3 + 36);
      v15 = _bittest(&v14, v11);
      v3 = v16;
      if( v15 )
      {
        if( v13 )
          v9 = 1;
      }
    }
    ++v11;
    ++v12;
  }
  while( v11 < 7 );
  if( v9 )
    ZwUpdateWnfStateData();
  if( v5 )
    ZwDeleteWnfStateName(&StateName);
}

Referenced by: