RtlRaiseCustomSystemEventTrigger

NTSTATUS __fastcall RtlRaiseCustomSystemEventTrigger(INT64 a1){
  int updated; 
  char *v2; 
  char *v3; 
  VOID *Buffer; 
  VOID *Buffera; 
  UINT64 *BufferSize; 
  UINT64 CheckStamp; 
  UINT64 InfoBuffer; 
  UINT64 ChangeStamp; 
  INT64 v11; 
  _UNICODE_STRING DestinationString; 
  __int128 v13; 
  _WNF_STATE_NAME StateName; 
  _GUID Guid; 

  HIDWORD(InfoBuffer) = 0;
  LODWORD(ChangeStamp) = 0;
  v11 = 0i64;
  StateName = (_WNF_STATE_NAME)WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED;
  v13 = 0i64;
  DestinationString = 0i64;
  Guid = 0i64;
  if( !a1 )
    return -1073741811;
  RtlInitUnicodeString(&DestinationString, *(PCWSTR *)(a1 + 8));
  updated = RtlGUIDFromString(&DestinationString, &Guid);
  if( updated < 0 )
    return updated;
  if( _InterlockedExchange(&RtlpCtPublishInProgress, 1) )
    return -1073741823;
  LODWORD(InfoBuffer) = 4096;
  LODWORD(v2) = RtlpCtAllocateMemory(4096);
  v3 = v2;
  if( v2 )
  {
    updated = ZwQueryWnfStateData(&StateName, 0i64, 0i64, &ChangeStamp, v2, &InfoBuffer);
    if( updated >= 0 )
    {
      LODWORD(Buffer) = 4;
      updated = ZwQueryWnfStateNameInformation(
                  &StateName,
                  WnfInfoIsQuiescent,
                  0i64,
                  (char *)&InfoBuffer + 4,
                  (UINT64)Buffer);
      if( updated >= 0 )
      {
        if( HIDWORD(InfoBuffer) )
        {
          LODWORD(Buffera) = 4;
          updated = ZwQueryWnfStateNameInformation(
                      &StateName,
                      WnfInfoSubscribersPresent,
                      0i64,
                      (char *)&InfoBuffer + 4,
                      (UINT64)Buffera);
          if( updated >= 0 )
          {
            if( HIDWORD(InfoBuffer) )
            {
              LODWORD(InfoBuffer) = 4096;
              if( v3 == (char *)-8i64 )
              {
                updated = -1073741811;
              }
              else
              {
                updated = 0;
                *(_OWORD *)(v3 + 8) = v13;
                *(_GUID *)(v3 + 24) = Guid;
                *((_DWORD *)v3 + 10) = 16;
                LODWORD(InfoBuffer) = 36;
              }
              if( updated >= 0 )
              {
                *(_DWORD *)v3 = 0;
                *((_DWORD *)v3 + 1) = -1;
                *(_DWORD *)v3 = 4 * (InfoBuffer & 0xFFF | 0x100000);
                updated = RtlpCtContextInit(&v11, (unsigned int)ChangeStamp);
                if( updated >= 0 )
                {
                  LODWORD(CheckStamp) = 1;
                  LODWORD(BufferSize) = ChangeStamp;
                  updated = ZwUpdateWnfStateData(
                              &StateName,
                              v3,
                              (unsigned int)(InfoBuffer + 8),
                              0i64,
                              0i64,
                              (UINT64)BufferSize,
                              CheckStamp);
                  if( updated >= 0 )
                  {
                    RtlpCtQueueWorkItem(*(_WORK_QUEUE_ITEM **)v11);
                    goto LABEL_25;
                  }
                }
                if( v11 )
                  RtlpCtContextFree((PVOID)v11);
              }
            }
            else
            {
              updated = -1073741653;
            }
          }
        }
        else
        {
          updated = -1073741823;
        }
      }
    }
  }
  else
  {
    updated = -1073741670;
  }
  _InterlockedExchange(&RtlpCtPublishInProgress, 0);
LABEL_25:
  if( v3 )
    RtlpCtFreeMemory(v3);
  return updated;
}

Referenced by: