NtQueryWnfStateData

NTSTATUS __stdcall NtQueryWnfStateData(
        const _WNF_STATE_NAME *StateName,
        const _WNF_TYPE_ID *TypeId,
        const VOID *ExplicitScope,
        UINT64 *ChangeStamp,
        VOID *Buffer,
        UINT64 *BufferSize){
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  unsigned __int64 v9; 
  int StateData; 
  VOID *v11; 
  unsigned __int64 v12; 
  unsigned int *v13; 
  unsigned __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 bf_0; 
  unsigned __int64 v19; 
  int v20; 
  _ETHREAD *v21; 
  _EPROCESS *v22; 
  NTSTATUS v23; 
  UINT64 *v24; 
  VOID **CapturedScopeData; 
  _WNF_DATA_SCOPE DataScope; 
  unsigned int DataSize; 
  _WNF_NAME_INSTANCE *NameInstance; 
  VOID **StateNameRegistration; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  _EPROCESS *Process; 
  int v33; 
  _WNF_STATE_NAME_STRUCT InternalStateName; 
  _WNF_TYPE_ID *CapturedTypeId; 
  VOID *CapturedScopeInstanceId; 
  UINT64 *BytesCopied; 
  UINT64 *ChangeStampa; 
  VOID *Data; 
  _WNF_CAPTURED_INSTANCE_ID v40[4]; 
  __int128 v41; 

  ChangeStampa = ChangeStamp;
  Process = (_EPROCESS *)ExplicitScope;
  Data = Buffer;
  BytesCopied = BufferSize;
  InternalStateName._bf_0 = 0i64;
  v41 = 0i64;
  CapturedScopeInstanceId = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  StateNameRegistration = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  LODWORD(v9) = 0;
  *(_OWORD *)v40 = 0i64;
  CapturedTypeId = (_WNF_TYPE_ID *)TypeId;
  StateData = ExpCaptureWnfStateName(StateName, &InternalStateName, PreviousMode);
  if( StateData >= 0 )
  {
    if( PreviousMode )
    {
      if( v12 )
      {
        if( v12 >= 0x7FFFFFFF0000i64 )
          v12 = 0x7FFFFFFF0000i64;
        v41 = *(_OWORD *)v12;
        CapturedTypeId = (_WNF_TYPE_ID *)&v41;
      }
      v15 = v14;
      if( v14 >= 0x7FFFFFFF0000i64 )
        v15 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v15 = *(_DWORD *)v15;
      v16 = (__int64)v13;
      if( (unsigned __int64)v13 >= 0x7FFFFFFF0000i64 )
        v16 = 0x7FFFFFFF0000i64;
      v11 = (VOID *)*(unsigned int *)v16;
      DataSize = *(_DWORD *)v16;
      v17 = (__int64)v13;
      if( (unsigned __int64)v13 >= 0x7FFFFFFF0000i64 )
        v17 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v17 = *(_DWORD *)v17;
      if( (_DWORD)v11 )
        ProbeForWrite((UINT64)Buffer, (unsigned int)v11, 1i64);
    }
    else
    {
      DataSize = *v13;
    }
    bf_0 = InternalStateName._bf_0;
    v19 = ((unsigned __int64)InternalStateName._bf_0 >> 4) & 3;
    v33 = ((unsigned __int64)InternalStateName._bf_0 >> 4) & 3;
    v9 = ((unsigned __int64)InternalStateName._bf_0 >> 6) & 0xF;
    DataScope = ((unsigned __int64)InternalStateName._bf_0 >> 6) & 0xF;
    LOBYTE(v11) = PreviousMode;
    StateData = ExpWnfCaptureScopeInstanceId(
                  DataScope,
                  (VOID *)ExplicitScope,
                  v11,
                  &CapturedScopeInstanceId,
                  (VOID **)v40);
    if( StateData >= 0 )
    {
      if( PreviousMode )
      {
        v20 = 0;
        if( Process )
        {
          StateData = ExpWnfCheckCrossScopeAccess((_WNF_STATE_NAME_STRUCT)bf_0);
          if( StateData < 0 )
            goto LABEL_31;
        }
      }
      else
      {
        v20 = 1;
      }
      if( PreviousMode )
      {
        v21 = (_ETHREAD *)KeGetCurrentThread();
        v22 = v21->Tcb.ApcState.Process;
        bf_0 = InternalStateName._bf_0;
        LODWORD(v19) = v33;
        LODWORD(v9) = DataScope;
      }
      else
      {
        v21 = 0i64;
        v22 = PsInitialSystemProcess;
      }
      Process = v22;
      StateData = ExpWnfResolveScopeInstance(&ScopeInstance, v22, v21, (_WNF_DATA_SCOPE)v9, CapturedScopeInstanceId);
      if( StateData >= 0 )
      {
        v23 = ExpWnfLookupNameInstance(ScopeInstance, (_WNF_STATE_NAME_STRUCT)bf_0, &NameInstance);
        StateData = v23;
        if( v23 != -1073741772 || (_DWORD)v19 == 3 )
        {
          if( v23 < 0 )
            goto LABEL_31;
          LODWORD(CapturedScopeData) = v20;
          StateData = ExpWnfValidatePubSubPreconditions(
                        1ui64,
                        &NameInstance->StateNameInfo,
                        0i64,
                        CapturedTypeId,
                        (UINT64)CapturedScopeData);
          if( StateData < 0 )
            goto LABEL_31;
        }
        else
        {
          StateData = ExpWnfLookupPermanentName((_WNF_STATE_NAME_STRUCT)bf_0, &StateNameRegistration);
          if( StateData < 0 )
            goto LABEL_31;
          LODWORD(CapturedScopeData) = v20;
          StateData = ExpWnfValidatePubSubPreconditions(
                        1ui64,
                        (_WNF_STATE_NAME_REGISTRATION *)StateNameRegistration,
                        0i64,
                        CapturedTypeId,
                        (UINT64)CapturedScopeData);
          if( StateData < 0 )
            goto LABEL_31;
          if( (_DWORD)v9 == 5 || (bf_0 & 0x400) != 0 )
          {
            StateData = ExpWnfCreateNameInstance(
                          ScopeInstance,
                          (_WNF_STATE_NAME_STRUCT)bf_0,
                          (_WNF_STATE_NAME_REGISTRATION *)StateNameRegistration,
                          Process,
                          &NameInstance);
            ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
            StateNameRegistration = 0i64;
            if( StateData < 0 )
              goto LABEL_31;
          }
        }
        v24 = BytesCopied;
        if( NameInstance )
        {
          StateData = ExpWnfReadStateData(NameInstance, ChangeStampa, Data, DataSize, BytesCopied);
        }
        else
        {
          *(_DWORD *)ChangeStampa = 0;
          *(_DWORD *)v24 = 0;
          StateData = 0;
        }
      }
    }
  }
LABEL_31:
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( StateNameRegistration )
    ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
  KeLeaveCriticalRegion();
  ExpWnfReleaseCapturedScopeInstanceId((_WNF_DATA_SCOPE)v9, v40, PreviousMode);
  return StateData;
}

Referenced by: