NtQueryWnfStateNameInformation

NTSTATUS __stdcall NtQueryWnfStateNameInformation(
        _WNF_STATE_NAME *StateName,
        _WNF_STATE_NAME_INFORMATION NameInfoClass,
        VOID *ExplicitScope,
        VOID *InfoBuffer,
        UINT64 InfoBufferSize){
  _DWORD *v5; 
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  int v10; 
  VOID *v11; 
  __int64 bf_0; 
  int v13; 
  int v14; 
  unsigned int v15; 
  _ETHREAD *v16; 
  _ETHREAD *v17; 
  _EPROCESS *Process; 
  NTSTATUS v19; 
  _SECURITY_DESCRIPTOR *SecurityDescriptor; 
  int v22; 
  _WNF_DATA_SCOPE DataScope; 
  int v24; 
  _WNF_NAME_INSTANCE *NameInstance; 
  _WNF_STATE_NAME_STRUCT StateNamea; 
  int v27; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  VOID **StateNameRegistration; 
  VOID *CapturedScopeInstanceId; 
  _WNF_CAPTURED_INSTANCE_ID CapturedScopeData[14]; 

  v5 = InfoBuffer;
  StateNamea._bf_0 = 0i64;
  CapturedScopeInstanceId = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  StateNameRegistration = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  DataScope = WnfDataScopeSystem;
  *(_OWORD *)CapturedScopeData = 0i64;
  v10 = ExpCaptureWnfStateName(StateName, &StateNamea, PreviousMode);
  if( v10 >= 0 )
  {
    bf_0 = StateNamea._bf_0;
    v27 = ((unsigned __int64)StateNamea._bf_0 >> 4) & 3;
    DataScope = ((unsigned __int64)StateNamea._bf_0 >> 6) & 0xF;
    v10 = ExpWnfCaptureScopeInstanceId(
            DataScope,
            ExplicitScope,
            v11,
            &CapturedScopeInstanceId,
            (VOID **)CapturedScopeData);
    if( v10 >= 0 )
    {
      if( (unsigned int)NameInfoClass > WnfInfoIsQuiescent )
      {
        v10 = -1073741821;
      }
      else
      {
        if( (unsigned int)InfoBufferSize >= 4 )
        {
          if( PreviousMode )
            ProbeForWrite((UINT64)v5, (unsigned int)InfoBufferSize, 4i64);
          v13 = 1;
          if( NameInfoClass )
          {
            v24 = 0;
          }
          else
          {
            v24 = 1;
            if( ExplicitScope )
            {
              v10 = -1073741811;
              goto LABEL_52;
            }
          }
          if( PreviousMode && NameInfoClass )
          {
            v14 = 0;
            v22 = 0;
            if( ExplicitScope )
            {
              v10 = ExpWnfCheckCrossScopeAccess((_WNF_STATE_NAME_STRUCT)bf_0);
              if( v10 < 0 )
                goto LABEL_52;
              v14 = 0;
            }
          }
          else
          {
            v14 = 1;
            v22 = 1;
          }
          v15 = 0;
          if( !v14 && (unsigned int)(NameInfoClass - 1) <= 1 )
            v15 = 2;
          v16 = 0i64;
          if( PreviousMode )
          {
            v17 = (_ETHREAD *)KeGetCurrentThread();
            Process = v17->Tcb.ApcState.Process;
            bf_0 = StateNamea._bf_0;
            if( !v24 )
              v16 = v17;
          }
          else
          {
            Process = PsInitialSystemProcess;
          }
          v10 = ExpWnfResolveScopeInstance(&ScopeInstance, Process, v16, DataScope, CapturedScopeInstanceId);
          if( v10 < 0 )
            goto LABEL_52;
          v19 = ExpWnfLookupNameInstance(ScopeInstance, (_WNF_STATE_NAME_STRUCT)bf_0, &NameInstance);
          v10 = v19;
          if( v19 != -1073741772 || v27 == 3 )
          {
            if( v19 < 0 )
              goto LABEL_52;
            if( v22 )
              goto LABEL_29;
            SecurityDescriptor = NameInstance->StateNameInfo.SecurityDescriptor;
          }
          else
          {
            v10 = ExpWnfLookupPermanentName((_WNF_STATE_NAME_STRUCT)bf_0, &StateNameRegistration);
            if( v10 < 0 )
              goto LABEL_52;
            if( v22 )
            {
LABEL_29:
              if( NameInfoClass )
              {
                if( NameInfoClass == WnfInfoSubscribersPresent )
                {
                  if( NameInstance && NameInstance->DataSubscribersCount )
                    goto LABEL_36;
                }
                else if( !NameInstance || !NameInstance->CurrentDeliveryCount )
                {
                  goto LABEL_36;
                }
                v13 = 0;
              }
LABEL_36:
              *(_DWORD *)InfoBuffer = v13;
              v10 = 0;
              v5 = InfoBuffer;
              goto LABEL_37;
            }
            SecurityDescriptor = (_SECURITY_DESCRIPTOR *)StateNameRegistration[2];
          }
          v10 = ExpWnfCheckCallerAccess(SecurityDescriptor, v15);
          if( v10 >= 0 )
            goto LABEL_29;
LABEL_52:
          v5 = InfoBuffer;
          goto LABEL_37;
        }
        v10 = -1073741811;
      }
    }
  }
LABEL_37:
  if( v10 == -1073741772 && NameInfoClass == WnfInfoStateNameExist )
  {
    *v5 = 0;
    v10 = 0;
  }
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( StateNameRegistration )
    ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
  KeLeaveCriticalRegion();
  ExpWnfReleaseCapturedScopeInstanceId(DataScope, CapturedScopeData, PreviousMode);
  return v10;
}

Referenced by: