SLGetSubscriptionPfn

NTSTATUS __stdcall SLGetSubscriptionPfn(INT64 a1, VOID **a2){
  size_t v4; 
  VOID **v5; 
  NTSTATUS v7; 
  _EX_PUSH_LOCK *v8; 
  _EX_PUSH_LOCK *v9; 
  VOID **PoolWithTag; 
  __int64 v11; 
  NTSTATUS v12; 
  PVOID P; 
  _ETHREAD *CurrentThread; 
  __int64 *v15; 
  UINT64 NumberOfBytes; 
  _ETHREAD *v17; 

  v15 = &v11;
  v12 = 0;
  P = 0i64;
  v4 = 0;
  LODWORD(NumberOfBytes) = 0;
  if( *(_BYTE *)(a1 + 46856) )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v9 = (_EX_PUSH_LOCK *)(a1 + 46840);
    ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(a1 + 46840), 0i64);
    if( *(_BYTE *)(a1 + 46856) )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x82ui64, 542329939i64);
      P = PoolWithTag;
      if( !PoolWithTag )
      {
        v12 = -1073741595;
        local_unwind(v15, &loc_14094E004);
      }
      *(_OWORD *)PoolWithTag = *(_OWORD *)(a1 + 46858);
      *((_OWORD *)PoolWithTag + 1) = *(_OWORD *)(a1 + 46874);
      *((_OWORD *)PoolWithTag + 2) = *(_OWORD *)(a1 + 46890);
      *((_OWORD *)PoolWithTag + 3) = *(_OWORD *)(a1 + 46906);
      *((_OWORD *)PoolWithTag + 4) = *(_OWORD *)(a1 + 46922);
      *((_OWORD *)PoolWithTag + 5) = *(_OWORD *)(a1 + 46938);
      *((_OWORD *)PoolWithTag + 6) = *(_OWORD *)(a1 + 46954);
      *((_OWORD *)PoolWithTag + 7) = *(_OWORD *)(a1 + 46970);
      *((_WORD *)PoolWithTag + 64) = *(_WORD *)(a1 + 46986);
    }
    if( _InterlockedCompareExchange64(&v9->_bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v9);
    v8 = v9;
  }
  else
  {
    v12 = sub_1403B8E0C(a1, &qword_140983CB0, 0i64, 0i64, 0, &NumberOfBytes);
    if( v12 == -1073741789 )
    {
      v4 = NumberOfBytes;
      v5 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 542329939i64);
      P = v5;
      if( !v5 || v4 > 0x82 )
      {
        v12 = -1073741595;
        goto LABEL_7;
      }
      v12 = sub_1403B8E0C(a1, &qword_140983CB0, 0i64, v5, v4, &NumberOfBytes);
    }
    v17 = (_ETHREAD *)KeGetCurrentThread();
    --v17->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(a1 + 46840), 0i64);
    if( !*(_BYTE *)(a1 + 46856) )
    {
      v7 = v12;
      if( v12 >= 0 )
        memmove((VOID *)(a1 + 46858), P, v4);
      if( (int)(v7 + 0x80000000) < 0 || v7 == -1073741772 )
        *(_BYTE *)(a1 + 46856) = 1;
    }
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 46840), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)(a1 + 46840));
    v8 = (_EX_PUSH_LOCK *)(a1 + 46840);
  }
  KeAbPostRelease(v8);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  *a2 = P;
  P = 0i64;
LABEL_7:
  if( P )
    ExFreePoolWithTag(P, 0);
  return v12;
}

Referenced by: