PspAllocateAndQueryNotificationChannel

__int64 __fastcall PspAllocateAndQueryNotificationChannel(__int64 a1, __int64 a2, _OWORD *a3){
  bool v3; 
  char v7; 
  INT64 *p_a2a; 
  char v9; 
  _EJOB *v10; 
  int ObjectSecurity; 
  PSECURITY_DESCRIPTOR v13; 
  struct _DMA_ADAPTER *v14; 
  struct _ACL *PoolWithTag; 
  ACL *v16; 
  int v17; 
  PVOID v18; 
  BOOLEAN MemoryAllocated; 
  UINT8 EffectiveOnly; 
  char OwnerDefaulted[6]; 
  _EJOB *RootJob; 
  _TOKEN_TYPE TokenType; 
  PVOID TokenInformation; 
  ULONG AclLength; 
  PSID Owner; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  INT64 a2a; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  INT64 *v30; 
  __int128 v31[2]; 
  __int64 v32; 
  WNF_STATE_NAME StateName; 
  v3 = (*(_DWORD *)(a2 + 1320) & 0x800) == 0;
  MemoryAllocated = 0;
  EffectiveOnly = 0;
  a2a = 0i64;
  Owner = 0i64;
  v7 = 0;
  SecurityDescriptor = 0i64;
  p_a2a = 0i64;
  RootJob = 0i64;
  memset(v31, 0, sizeof(v31));
  v32 = 0i64;
  TokenType = 0;
  TokenInformation = 0i64;
  v30 = 0i64;
  StateName = 0i64;
  if( !v3 )
  {
    v9 = 1;
    PspLockRootJobExclusive((_EJOB *)a2, (_ETHREAD *)a1, &RootJob);
    v10 = RootJob;
    if( (_EJOB *)a2 != RootJob )
    {
      ExConvertExclusiveToSharedLite(&RootJob->JobLock);
      ExAcquireResourceExclusiveLite((ERESOURCE *)(a2 + 56), 1u);
    }
    goto LABEL_4;
  }
  ObjectSecurity = ObpGetObjectSecurity((PVOID)a2, &SecurityDescriptor, &MemoryAllocated, 0);
  if( ObjectSecurity < 0 )
    return(unsigned int)ObjectSecurity;
  v13 = SecurityDescriptor;
  if( !SecurityDescriptor )
  {
    ObjectSecurity = -1073741790;
LABEL_25:
    ObReleaseObjectSecurity(v13, MemoryAllocated);
    return(unsigned int)ObjectSecurity;
  }
  ObjectSecurity = RtlGetOwnerSecurityDescriptor(SecurityDescriptor, &Owner, (UINT8 *)OwnerDefaulted);
  if( ObjectSecurity < 0 )
    goto LABEL_25;
  v14 = (struct _DMA_ADAPTER *)PsReferenceEffectiveToken(
                                 (_ETHREAD *)a1,
                                 &TokenType,
                                 &EffectiveOnly,
                                 &ImpersonationLevel,
                                 0i64);
  ObjectSecurity = SeQueryInformationToken(v14, TokenUser, &TokenInformation);
  if( TokenType == TokenPrimary )
  {
    ObFastDereferenceObject((INT64 *)(*(_QWORD *)(a1 + 184) + 1208i64), v14);
  }
  else if( v14 )
  {
    HalPutDmaAdapter(v14);
  }
  if( ObjectSecurity < 0 )
    goto LABEL_25;
  AclLength = 4 * (*((unsigned __int8 *)Owner + 1) + *(unsigned __int8 *)(*(_QWORD *)TokenInformation + 1i64)) + 48;
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(NonPagedPoolNx, AclLength, 0x66577350ui64);
  v16 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_24;
  RtlCreateAcl(PoolWithTag, AclLength, 2u);
  RtlpAddKnownAce(v16, 2ui64, 0i64, 0x80000000ui64, Owner, 0);
  RtlpAddKnownAce(v16, 2ui64, 0i64, 0x80000000ui64, *(VOID **)TokenInformation, 0);
  RtlCreateSecurityDescriptor(v31, 1ui64);
  RtlSetDaclSecurityDescriptor(v31, 1u, v16, 0);
  ZwCreateWnfStateName();
  ObjectSecurity = v17;
  ExFreePoolWithTag(v16, 0x66577350u);
  if( ObjectSecurity < 0 )
  {
LABEL_24:
    ExFreePoolWithTag(TokenInformation, 0);
    goto LABEL_25;
  }
  v9 = 0;
  PspLockRootJobExclusive((_EJOB *)a2, (_ETHREAD *)a1, &RootJob);
  if( (*(_DWORD *)(a2 + 1320) & 0x800) != 0 )
  {
    v10 = RootJob;
    v7 = 1;
    p_a2a = v30;
  }
  else
  {
    *(WNF_STATE_NAME *)(a2 + 880) = StateName;
    p_a2a = &a2a;
    PspComputeReportWakeFilter((_DWORD *)a2, (INT64)&a2a, (_QWORD *)(a2 + 952), 0);
    PspEnumJobsAndProcessesInJobHierarchy(
      v18,
      0i64,
      (unsigned int(__fastcall *)(__int64, __int64))PspEnableWakeCounters,
      (__int64(__fastcall *)(_QWORD *, __int64))PspEnableProcessWakeCounters,
      0i64,
      2);
    _interlockedbittestandset((volatile signed __int32 *)(a2 + 1320), 0xBu);
    _InterlockedIncrement64(&PspJobTimeLimitsRequest);
    v10 = RootJob;
  }
LABEL_4:
  *a3 = *(_OWORD *)(a2 + 880);
  a3[1] = *(_OWORD *)(a2 + 896);
  a3[2] = *(_OWORD *)(a2 + 912);
  a3[3] = *(_OWORD *)(a2 + 928);
  if( v9 )
    PspUnlockJobConditionally((_EJOB *)a2, &RootJob);
  PspUnlockJob((__int64)v10, a1);
  if( v7 )
  {
    ZwDeleteWnfStateName(&StateName);
  }
  else if( !v9 )
  {
    PspDispatchWakeNotification((VOID *)a2, p_a2a, (INT64)a3);
  }
  return 0i64;
}

Referenced by: