__int64 __fastcall PopEsWnfSubscriptionOverrideCallback(_WNF_SUBSCRIPTION *a1){
int v1;
unsigned int v3;
__int64 v4[2];
UINT64 v5;
v3 = 0;
LODWORD(v4[0]) = 4;
if( ExQueryWnfStateData(a1, &v5, &v3, (UINT64 *)v4) >= 0 )
{
v1 = v3;
if( v3 <= 2 )
{
PopAcquireRwLockExclusive(&PopEsLock);
PopEsMode = v1;
PopReleaseRwLock(&PopEsLock);
PopEsWorkItemSchedule(2ui64);
}
}
return 0i64;
}