ExpWnfAcquireSubscriptionByName

NTSTATUS __stdcall ExpWnfAcquireSubscriptionByName(
        _WNF_STATE_NAME_STRUCT StateName,
        _WNF_PROCESS_CONTEXT *ProcessContext,
        _WNF_SUBSCRIPTION **Subscription){
  _WNF_LOCK *p_ProcessSubscriptionListLock; 
  _BYTE *v7; 
  _WNF_PROCESS_CONTEXT *i; 
  _WNF_SUBSCRIPTION *p_DeliveryPendingListHead; 
  NTSTATUS result; 

  p_ProcessSubscriptionListLock = &ProcessContext->ProcessSubscriptionListLock;
  v7 = KeAbPreAcquire(&ProcessContext->ProcessSubscriptionListLock, 0i64, 0i64);
  if( _InterlockedCompareExchange64(&p_ProcessSubscriptionListLock->PushLock._bf_0, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&p_ProcessSubscriptionListLock->PushLock, v7, p_ProcessSubscriptionListLock);
  if( v7 )
    v7[26] |= 1u;
  for( i = (_WNF_PROCESS_CONTEXT *)ProcessContext->ProcessSubscriptionListHead.Flink;
        i != (_WNF_PROCESS_CONTEXT *)&ProcessContext->ProcessSubscriptionListHead;
        i = *(_WNF_PROCESS_CONTEXT **)&i->Header.NodeTypeCode )
  {
    p_DeliveryPendingListHead = (_WNF_SUBSCRIPTION *)&i[-1].DeliveryPendingListHead;
    if( i->ImplicitScopeInstances[0] == (void *)StateName._bf_0 )
    {
      ExAcquireRundownProtection(&p_DeliveryPendingListHead->RunRef);
      if( _InterlockedCompareExchange64(&p_ProcessSubscriptionListLock->PushLock._bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(&p_ProcessSubscriptionListLock->PushLock);
      KeAbPostRelease(p_ProcessSubscriptionListLock);
      result = 0;
      *Subscription = p_DeliveryPendingListHead;
      return result;
    }
  }
  if( _InterlockedCompareExchange64(&p_ProcessSubscriptionListLock->PushLock._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&p_ProcessSubscriptionListLock->PushLock);
  KeAbPostRelease(p_ProcessSubscriptionListLock);
  return -1073741772;
}

Referenced by: