NtSubscribeWnfStateChange

NTSTATUS __stdcall NtSubscribeWnfStateChange(
        _WNF_STATE_NAME *StateName,
        UINT64 ChangeStamp,
        UINT64 EventMask,
        UINT64 *SubscriptionId){
  int v5; 
  int v6; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v9; 
  UINT64 v11; 

  v5 = EventMask;
  v6 = ChangeStamp;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v11 = 0i64;
  if( SubscriptionId )
  {
    ProbeForWrite((UINT64)SubscriptionId, 8i64, 1i64);
    *SubscriptionId = 0i64;
  }
  v9 = ExpWnfSubscribeWnfStateChange(
         (UINT64 *)((unsigned __int64)&v11 & -(__int64)(SubscriptionId != 0i64)),
         0i64,
         StateName,
         v6,
         0i64,
         0i64,
         v5,
         1);
  if( v9 >= 0 && SubscriptionId )
    *SubscriptionId = v11;
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v9;
}

Referenced by: