NtGetCompleteWnfStateSubscription

NTSTATUS __stdcall NtGetCompleteWnfStateSubscription(
        _WNF_STATE_NAME *OldDescriptorStateName,
        UINT64 *OldSubscriptionId,
        UINT64 OldDescriptorEventMask,
        UINT64 OldDescriptorStatus,
        _WNF_DELIVERY_DESCRIPTOR *NewDeliveryDescriptor,
        UINT64 DescriptorSize){
  __int64 v7; 
  _ETHREAD *CurrentThread; 
  int v9; 
  _WNF_PROCESS_CONTEXT *WnfContext; 
  UINT64 OldStatus; 
  __int64 OldStateName; 

  v7 = (__int64)OldDescriptorStateName;
  OldStateName = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v9 = -1073741811;
  WnfContext = (_WNF_PROCESS_CONTEXT *)KeGetCurrentThread()->ApcState.Process->WnfContext;
  if( WnfContext )
  {
    if( !OldDescriptorStateName || !OldSubscriptionId )
      goto LABEL_11;
    if( (_DWORD)OldDescriptorEventMask && (!(_DWORD)OldDescriptorStatus || (_DWORD)OldDescriptorStatus == -1073741267) )
    {
      if( (unsigned __int64)OldDescriptorStateName >= 0x7FFFFFFF0000i64 )
        v7 = 0x7FFFFFFF0000i64;
      OldStateName = *(_QWORD *)v7;
      if( (unsigned __int64)OldSubscriptionId >= 0x7FFFFFFF0000i64 )
        OldSubscriptionId = (UINT64 *)0x7FFFFFFF0000i64;
      LODWORD(OldStatus) = OldDescriptorStatus;
      v9 = ExpWnfCompleteThreadSubscriptions(
             WnfContext,
             &OldStateName,
             *OldSubscriptionId,
             (unsigned int)OldDescriptorEventMask,
             OldStatus);
      if( v9 >= 0 )
      {
LABEL_11:
        if( (_DWORD)DescriptorSize )
        {
          if( (unsigned int)DescriptorSize < 0x1030 )
          {
            v9 = -1073741789;
          }
          else
          {
            ProbeForWrite((UINT64)NewDeliveryDescriptor, (unsigned int)DescriptorSize, 8i64);
            v9 = ExpWnfDeliverThreadNotifications(WnfContext, NewDeliveryDescriptor, (unsigned int)DescriptorSize);
          }
        }
      }
    }
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v9;
}

Referenced by: