PnpInitializeNotifyEntry

__int64 __fastcall PnpInitializeNotifyEntry(__int64 a1, int a2, VOID *a3, __int64 a4, __int64 a5, __int64 a6){
  VOID *v7; 
  unsigned int v11; 
  NTSTATUS v12; 
  VOID **PoolWithTag; 
  unsigned int SessionId; 
  VOID *SessionHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR Dst[256]; 

  v7 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  SessionHandle = 0i64;
  v11 = 0;
  v12 = 0;
  DestinationString = 0i64;
  if( !MmIsSessionAddress(a3) )
    goto LABEL_2;
  SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
  v11 = SessionId;
  if( SessionId == -1 )
    return(unsigned int)-1073741811;
  swprintf_s(Dst, 0x100ui64, (WCHAR *)L"\\KernelObjects\\Session%d", SessionId);
  RtlInitUnicodeString(&DestinationString, Dst);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v12 = ZwOpenSession(&SessionHandle, 0i64, &ObjectAttributes);
  if( v12 < 0 || (v7 = SessionHandle) == 0i64 )
  {
    return(unsigned int)-1073741811;
  }
  else
  {
LABEL_2:
    *(_QWORD *)(a1 + 48) = a5;
    *(_QWORD *)(a1 + 8) = a1;
    *(_WORD *)(a1 + 56) = 1;
    *(_QWORD *)(a1 + 64) = a6;
    *(_QWORD *)a1 = a1;
    *(_DWORD *)(a1 + 16) = a2;
    *(_DWORD *)(a1 + 20) = v11;
    *(_QWORD *)(a1 + 24) = v7;
    *(_QWORD *)(a1 + 32) = a3;
    *(_QWORD *)(a1 + 40) = a4;
    *(_BYTE *)(a1 + 58) = 0;
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x68ui64, 1450208848i64);
    *(_QWORD *)(a1 + 72) = PoolWithTag;
    if( PoolWithTag )
      ExInitializeResourceLite((INT64)PoolWithTag);
    else
      return(unsigned int)-1073741670;
  }
  return(unsigned int)v12;
}

Referenced by: