ExpWnfDispatchKernelSubscription

VOID __stdcall ExpWnfDispatchKernelSubscription(){
  _EX_PUSH_LOCK *WnfContext; 
  volatile signed __int64 *p_bf_0; 
  _BYTE *v2; 
  _BYTE *v3; 
  _EX_RUNDOWN_REF *bf_0; 
  _EX_RUNDOWN_REF *v5; 
  _EX_RUNDOWN_REF v6; 
  _EX_RUNDOWN_REF **Count; 
  volatile signed __int64 *v8; 
  unsigned int Ptr_high; 
  _BYTE *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  const _WNF_TYPE_ID *v14; 
  __int64 v15; 
  _BYTE *v16; 
  _BYTE *v17; 
  unsigned __int64 v18; 

  v18 = 0i64;
  WnfContext = (_EX_PUSH_LOCK *)PsInitialSystemProcess->WnfContext;
  p_bf_0 = &WnfContext[13]._bf_0;
  v2 = KeAbPreAcquire(&WnfContext[13], 0i64, 0i64);
  v3 = v2;
  if( _interlockedbittestandset64((volatile signed __int32 *)&WnfContext[13], 0i64) )
    ExfAcquirePushLockExclusiveEx(WnfContext + 13, v2, &WnfContext[13]);
  if( v3 )
    v3[26] |= 1u;
  while( 1 )
  {
    bf_0 = (_EX_RUNDOWN_REF *)WnfContext[14]._bf_0;
    if( bf_0 == (_EX_RUNDOWN_REF *)&WnfContext[14] )
      break;
    v5 = bf_0 - 13;
    ExAcquireRundownProtection(bf_0 - 12);
    LODWORD(bf_0[2].Count) = 2;
    v6.Count = bf_0->Count;
    if( *(_EX_RUNDOWN_REF **)(bf_0->Count + 8) != bf_0 || (Count = (_EX_RUNDOWN_REF **)bf_0[1].Count, *Count != bf_0) )
      __fastfail(3u);
    *Count = (_EX_RUNDOWN_REF *)v6.Count;
    v8 = &WnfContext[10]._bf_0;
    *(_QWORD *)(v6.Count + 8) = Count;
    Ptr_high = HIDWORD(v5[15].Ptr);
    do
    {
      HIDWORD(v5[15].Ptr) = 0;
      if( (_InterlockedExchangeAdd64(p_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(WnfContext + 13);
      KeAbPostRelease(&WnfContext[13]);
      v10 = KeAbPreAcquire(&WnfContext[10], 0i64, 0i64);
      if( _InterlockedCompareExchange64(v8, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx(WnfContext + 10, v10, &WnfContext[10]);
      if( v10 )
        v10[26] |= 1u;
      v11 = v5[6].Count;
      if( v11 )
        v11 &= -(__int64)(ExAcquireRundownProtection((_EX_RUNDOWN_REF *)(v11 + 8)) != 0);
      v12 = Ptr_high & 0xFFFFFFFE;
      if( v11 )
        v12 = Ptr_high;
      if( (v12 & 1) != 0 )
      {
        v13 = *(_DWORD *)(v11 + 96);
        if( v13 <= LODWORD(v5[12].Count) )
          v12 &= ~1u;
        else
          LODWORD(v5[12].Count) = v13;
      }
      if( v12 )
      {
        if( _InterlockedCompareExchange64(v8, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(WnfContext + 10);
        KeAbPostRelease(&WnfContext[10]);
        v18 = v5[7].Count ^ 0x41C64E6DA3BC0074i64;
        if( v11 )
          v14 = *(const _WNF_TYPE_ID **)(v11 + 64);
        else
          v14 = 0i64;
        if( v11 && (v12 & 1) != 0 )
          v15 = *(unsigned int *)(v11 + 96);
        else
          v15 = 0i64;
        ((void(__fastcall *)(_EX_RUNDOWN_REF *, unsigned __int64 *, _QWORD, __int64, const _WNF_TYPE_ID *, unsigned __int64))v5[10].Count)(
          v5,
          &v18,
          v12,
          v15,
          v14,
          v5[11].Count);
        if( (v12 & 1) != 0 && _InterlockedExchangeAdd((volatile signed __int32 *)(v11 + 164), 0xFFFFFFFF) == 1 )
          ExpWnfNotifyNameSubscribers((_WNF_NAME_INSTANCE *)v11, 8ui64, 0i64, 0i64);
      }
      else
      {
        if( _InterlockedCompareExchange64(v8, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(WnfContext + 10);
        KeAbPostRelease(&WnfContext[10]);
      }
      if( v11 )
        ExReleaseRundownProtection((_EX_RUNDOWN_REF *)(v11 + 8));
      v16 = KeAbPreAcquire(&WnfContext[13], 0i64, 0i64);
      v17 = v16;
      if( _interlockedbittestandset64((volatile signed __int32 *)p_bf_0, 0i64) )
        ExfAcquirePushLockExclusiveEx(WnfContext + 13, v16, &WnfContext[13]);
      if( v17 )
        v17[26] |= 1u;
      Ptr_high = HIDWORD(v5[15].Ptr);
    }
    while( Ptr_high );
    LODWORD(v5[15].Count) = 0;
    ExReleaseRundownProtection(v5 + 1);
  }
  if( (_InterlockedExchangeAdd64(p_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(WnfContext + 13);
  KeAbPostRelease(&WnfContext[13]);
}

Referenced by: