ExpWnfDispatchKernelSubscription

VOID __stdcall ExpWnfDispatchKernelSubscription(){
  _QWORD *v0; 
  volatile signed __int64 *v1; 
  _BYTE *v2; 
  _BYTE *v3; 
  struct _EX_RUNDOWN_REF *v4; 
  struct _EX_RUNDOWN_REF *v5; 
  struct _EX_RUNDOWN_REF v6; 
  struct _EX_RUNDOWN_REF **Count; 
  volatile signed __int64 *v8; 
  unsigned int Ptr_high; 
  _BYTE *v10; 
  _BYTE *v11; 
  INT64 v12; 
  unsigned int v13; 
  unsigned int v14; 
  __int64 v15; 
  __int64 v16; 
  _BYTE *v17; 
  _BYTE *v18; 
  unsigned __int64 v19; 
  v19 = 0i64;
  v0 = (_QWORD *)*((_QWORD *)PsInitialSystemProcess + 269);
  v1 = v0 + 13;
  LODWORD(v2) = KeAbPreAcquire(v0 + 13, 0i64, 0i64);
  v3 = v2;
  if( _interlockedbittestandset64((volatile signed __int32 *)v0 + 26, 0i64) )
    ExfAcquirePushLockExclusiveEx(v0 + 13, v2, v0 + 13);
  if( v3 )
    v3[26] |= 1u;
  while( 1 )
  {
    v4 = (struct _EX_RUNDOWN_REF *)v0[14];
    if( v4 == (struct _EX_RUNDOWN_REF *)(v0 + 14) )
      break;
    v5 = v4 - 13;
    ExAcquireRundownProtection(v4 - 12);
    LODWORD(v4[2].Count) = 2;
    v6.Count = v4->Count;
    if( *(struct _EX_RUNDOWN_REF **)(v4->Count + 8) != v4
      || (Count = (struct _EX_RUNDOWN_REF **)v4[1].Count, *Count != v4) )
    {
      __fastfail(3u);
    }
    *Count = (struct _EX_RUNDOWN_REF *)v6.Count;
    v8 = v0 + 10;
    *(_QWORD *)(v6.Count + 8) = Count;
    Ptr_high = HIDWORD(v5[15].Ptr);
    do
    {
      HIDWORD(v5[15].Ptr) = 0;
      if( (_InterlockedExchangeAdd64(v1, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v0 + 13);
      KeAbPostRelease(v0 + 13);
      LODWORD(v10) = KeAbPreAcquire(v0 + 10, 0i64, 0i64);
      v11 = v10;
      if( _InterlockedCompareExchange64(v8, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx(v0 + 10, v10, v0 + 10);
      if( v11 )
        v11[26] |= 1u;
      v12 = v5[6].Count;
      if( v12 )
        v12 &= -(__int64)ExAcquireRundownProtection((PEX_RUNDOWN_REF)(v12 + 8));
      v13 = Ptr_high & 0xFFFFFFFE;
      if( v12 )
        v13 = Ptr_high;
      if( (v13 & 1) != 0 )
      {
        v14 = *(_DWORD *)(v12 + 96);
        if( v14 <= LODWORD(v5[12].Count) )
          v13 &= ~1u;
        else
          LODWORD(v5[12].Count) = v14;
      }
      if( v13 )
      {
        if( _InterlockedCompareExchange64(v8, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(v0 + 10);
        KeAbPostRelease(v0 + 10);
        v19 = v5[7].Count ^ 0x41C64E6DA3BC0074i64;
        if( v12 )
          v15 = *(_QWORD *)(v12 + 64);
        else
          v15 = 0i64;
        if( v12 && (v13 & 1) != 0 )
          v16 = *(unsigned int *)(v12 + 96);
        else
          v16 = 0i64;
        ((void(__fastcall *)(struct _EX_RUNDOWN_REF *, unsigned __int64 *, _QWORD, __int64, __int64, unsigned __int64))v5[10].Count)(
          v5,
          &v19,
          v13,
          v16,
          v15,
          v5[11].Count);
        if( (v13 & 1) != 0 && _InterlockedExchangeAdd((volatile signed __int32 *)(v12 + 164), 0xFFFFFFFF) == 1 )
          ExpWnfNotifyNameSubscribers(v12, 8ui64, 0i64, 0i64);
      }
      else
      {
        if( _InterlockedCompareExchange64(v8, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(v0 + 10);
        KeAbPostRelease(v0 + 10);
      }
      if( v12 )
        ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v12 + 8));
      LODWORD(v17) = KeAbPreAcquire(v0 + 13, 0i64, 0i64);
      v18 = v17;
      if( _interlockedbittestandset64((volatile signed __int32 *)v1, 0i64) )
        ExfAcquirePushLockExclusiveEx(v0 + 13, v17, v0 + 13);
      if( v18 )
        v18[26] |= 1u;
      Ptr_high = HIDWORD(v5[15].Ptr);
    }
    while( Ptr_high );
    LODWORD(v5[15].Count) = 0;
    ExReleaseRundownProtection(v5 + 1);
  }
  if( (_InterlockedExchangeAdd64(v1, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v0 + 13);
  KeAbPostRelease(v0 + 13);
}

Referenced by: