ExpNtUpdateWnfStateData

NTSTATUS __stdcall ExpNtUpdateWnfStateData(
        const PFN_WDFIOTARGETOPEN *a1,
        _XSTATE_FEATURE *a2,
        INT64 a3,
        StartMirroringRoutine *a4,
        INT64 ScopeInstanceId,
        _XSTATE_CONFIGURATION *MatchingChangeStamp,
        _XSTATE_CONFIGURATION *CheckStamp,
        INT64 a8){
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  unsigned __int64 v10; 
  int NameInstance; 
  VOID *v12; 
  unsigned __int64 v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  INT64 v16; 
  _ETHREAD *v17; 
  _EPROCESS *v18; 
  __int64 bf_0; 
  _WNF_SCOPE_INSTANCE *v20; 
  NTSTATUS v21; 
  unsigned int v22; 
  VOID **v24; 
  _EX_PUSH_LOCK *v25; 
  _BYTE *v26; 
  __int64 v27; 
  INT64 v28; 
  INT64 v29; 
  VOID **CapturedScopeData; 
  VOID **CapturedScopeDataa; 
  INT64 v32; 
  _WNF_DATA_SCOPE DataScope; 
  _DWORD Length[3]; 
  UINT64 BypassAccessChecks; 
  _WNF_STATE_NAME_STRUCT InternalStateName; 
  VOID **StateNameRegistration; 
  int v38; 
  VOID *CapturedScopeInstanceId; 
  _WNF_TYPE_ID *CapturedTypeId; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  VOID *Data; 
  _EPROCESS *Process; 
  _WNF_CAPTURED_INSTANCE_ID v44[4]; 
  INT64 v45; 
  INT64 v46; 
  __int128 v47; 

  Length[0] = a3;
  Data = a2;
  InternalStateName._bf_0 = 0i64;
  v47 = 0i64;
  CapturedScopeInstanceId = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  StateNameRegistration = 0i64;
  ScopeInstance = 0i64;
  *(_QWORD *)&Length[1] = 0i64;
  LODWORD(v10) = 0;
  *(_OWORD *)v44 = 0i64;
  CapturedTypeId = (_WNF_TYPE_ID *)a4;
  NameInstance = ExpCaptureWnfStateName((const _WNF_STATE_NAME *)a1, &InternalStateName, PreviousMode);
  if( NameInstance < 0 )
    goto LABEL_26;
  v38 = ((unsigned __int64)InternalStateName._bf_0 >> 4) & 3;
  v10 = ((unsigned __int64)InternalStateName._bf_0 >> 6) & 0xF;
  DataScope = ((unsigned __int64)InternalStateName._bf_0 >> 6) & 0xF;
  if( PreviousMode )
  {
    if( (_DWORD)v14 && (v15 + v14 > 0x7FFFFFFF0000i64 || v15 + v14 < v15) )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( v13 )
    {
      if( v13 >= 0x7FFFFFFF0000i64 )
        v13 = 0x7FFFFFFF0000i64;
      v47 = *(_OWORD *)v13;
      CapturedTypeId = (_WNF_TYPE_ID *)&v47;
    }
  }
  LOBYTE(v12) = PreviousMode;
  NameInstance = ExpWnfCaptureScopeInstanceId(
                   (_WNF_DATA_SCOPE)(((unsigned __int64)InternalStateName._bf_0 >> 6) & 0xF),
                   (VOID *)ScopeInstanceId,
                   v12,
                   &CapturedScopeInstanceId,
                   (VOID **)v44);
  if( NameInstance < 0 )
    goto LABEL_26;
  if( PreviousMode )
  {
    LODWORD(BypassAccessChecks) = 0;
    if( ScopeInstanceId )
    {
      NameInstance = ExpWnfCheckCrossScopeAccess(InternalStateName);
      if( NameInstance < 0 )
        goto LABEL_26;
    }
  }
  else
  {
    LODWORD(BypassAccessChecks) = 1;
  }
  if( PreviousMode )
  {
    v17 = (_ETHREAD *)KeGetCurrentThread();
    v18 = v17->Tcb.ApcState.Process;
    Process = v18;
    LODWORD(v10) = DataScope;
    if( DataScope == WnfDataScopeProcess && (!CapturedScopeInstanceId || v18 == *(_EPROCESS **)CapturedScopeInstanceId) )
      goto LABEL_44;
  }
  else
  {
    v17 = 0i64;
    v18 = PsInitialSystemProcess;
    Process = PsInitialSystemProcess;
  }
  if( (_DWORD)v10 == 5 && (_DWORD)a8 )
  {
    if( (_DWORD)CheckStamp )
    {
LABEL_44:
      NameInstance = -1073741811;
      goto LABEL_26;
    }
    v45 = InternalStateName._bf_0 ^ 0x41C64E6DA3BC0074i64;
    LODWORD(v32) = Length[0];
    NameInstance = ExpCrossVmWnfPush(v16, 1ui64, (INT64)&v45, 0xFFFFFFFFui64, (INT64)Data, v32);
    if( NameInstance != -1073741822 )
      goto LABEL_26;
  }
  NameInstance = ExpWnfResolveScopeInstance(&ScopeInstance, v18, v17, (_WNF_DATA_SCOPE)v10, CapturedScopeInstanceId);
  if( NameInstance < 0 )
    goto LABEL_26;
  bf_0 = InternalStateName._bf_0;
  v20 = ScopeInstance;
  v21 = ExpWnfLookupNameInstance(ScopeInstance, InternalStateName, (_WNF_NAME_INSTANCE **)&Length[1]);
  NameInstance = v21;
  if( v21 != -1073741772 || v38 == 3 )
  {
    if( v21 < 0 )
      goto LABEL_26;
    LODWORD(CapturedScopeData) = BypassAccessChecks;
    v22 = Length[0];
    NameInstance = ExpWnfValidatePubSubPreconditions(
                     2ui64,
                     (_WNF_STATE_NAME_REGISTRATION *)(*(_QWORD *)&Length[1] + 56i64),
                     Length[0],
                     CapturedTypeId,
                     (UINT64)CapturedScopeData);
    if( NameInstance < 0 )
      goto LABEL_26;
  }
  else
  {
    NameInstance = ExpWnfLookupPermanentName((_WNF_STATE_NAME_STRUCT)bf_0, &StateNameRegistration);
    if( NameInstance < 0 )
      goto LABEL_26;
    LODWORD(CapturedScopeData) = BypassAccessChecks;
    v24 = StateNameRegistration;
    NameInstance = ExpWnfValidatePubSubPreconditions(
                     2ui64,
                     (_WNF_STATE_NAME_REGISTRATION *)StateNameRegistration,
                     Length[0],
                     CapturedTypeId,
                     (UINT64)CapturedScopeData);
    if( NameInstance < 0 )
      goto LABEL_26;
    NameInstance = ExpWnfCreateNameInstance(
                     v20,
                     (_WNF_STATE_NAME_STRUCT)bf_0,
                     (_WNF_STATE_NAME_REGISTRATION *)v24,
                     Process,
                     (_WNF_NAME_INSTANCE **)&Length[1]);
    ExFreePoolWithTag(v24, 0x20666E57u);
    StateNameRegistration = 0i64;
    if( NameInstance < 0 )
      goto LABEL_26;
    v22 = Length[0];
  }
  LODWORD(CapturedScopeDataa) = (_DWORD)CheckStamp;
  NameInstance = ExpWnfWriteStateData(
                   *(_WNF_NAME_INSTANCE **)&Length[1],
                   Data,
                   v22,
                   (unsigned int)MatchingChangeStamp,
                   (UINT64)CapturedScopeDataa);
  if( NameInstance >= 0 )
  {
    if( (_DWORD)v10 == 5 )
    {
      v46 = InternalStateName._bf_0 ^ 0x41C64E6DA3BC0074i64;
      v25 = (_EX_PUSH_LOCK *)(*(_QWORD *)&Length[1] + 80i64);
      v26 = KeAbPreAcquire((VOID *)(*(_QWORD *)&Length[1] + 80i64), 0i64, 0i64);
      if( _InterlockedCompareExchange64(&v25->_bf_0, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx(v25, v26, v25);
      if( v26 )
        v26[26] |= 1u;
      v27 = 0i64;
      if( *(_QWORD *)(*(_QWORD *)&Length[1] + 88i64) != 1i64 )
        v27 = *(_QWORD *)(*(_QWORD *)&Length[1] + 88i64);
      if( v27 )
      {
        v28 = v27 + 16;
        v29 = *(unsigned int *)(v27 + 8);
      }
      else
      {
        v28 = 0i64;
        v29 = 0i64;
      }
      LODWORD(v32) = v29;
      ExpCrossVmWnfPush(v29, 0i64, (INT64)&v46, *(unsigned int *)(*(_QWORD *)&Length[1] + 96i64), v28, v32);
      if( _InterlockedCompareExchange64(&v25->_bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v25);
      KeAbPostRelease(v25);
      LODWORD(v10) = DataScope;
    }
    ExpWnfNotifyNameSubscribers(*(_WNF_NAME_INSTANCE **)&Length[1], 1ui64, 1ui64, PreviousMode != 0);
    NameInstance = 0;
  }
LABEL_26:
  if( *(_QWORD *)&Length[1] )
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)(*(_QWORD *)&Length[1] + 8i64));
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( StateNameRegistration )
    ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
  KeLeaveCriticalRegion();
  ExpWnfReleaseCapturedScopeInstanceId((_WNF_DATA_SCOPE)v10, v44, PreviousMode);
  return NameInstance;
}

Referenced by: