ExpWnfDeleteSubscription

VOID __stdcall ExpWnfDeleteSubscription(VOID *Subscription, PEPROCESS Process){
  _EX_PUSH_LOCK *WnfContext; 
  int v4; 
  _BYTE *v5; 
  _BYTE *v6; 
  _WNF_NAME_INSTANCE *v7; 
  int v8; 
  _BYTE *v9; 
  _BYTE *v10; 
  VOID **v11; 
  VOID **v12; 
  int v13; 
  VOID **v14; 
  VOID **v15; 
  _BYTE *v16; 
  _BYTE *v17; 
  int v18; 
  int v19; 
  VOID **v20; 
  VOID **v21; 
  _BOOL4 v23; 

  WnfContext = (_EX_PUSH_LOCK *)Process->WnfContext;
  v4 = 1;
  if( WnfContext )
  {
    v5 = KeAbPreAcquire(&WnfContext[10], 0i64, 0i64);
    v6 = v5;
    if( _interlockedbittestandset64((volatile signed __int32 *)&WnfContext[10], 0i64) )
      ExfAcquirePushLockExclusiveEx(WnfContext + 10, v5, &WnfContext[10]);
    if( v6 )
      v6[26] |= 1u;
  }
  if( !*((_QWORD *)Subscription + 5) )
  {
    v4 = 0;
    goto LABEL_42;
  }
  v7 = (_WNF_NAME_INSTANCE *)*((_QWORD *)Subscription + 6);
  v8 = 0;
  v23 = 0;
  if( v7 )
  {
    v9 = KeAbPreAcquire(&v7->StateSubscriptionListLock, 0i64, 0i64);
    v10 = v9;
    if( _interlockedbittestandset64((volatile signed __int32 *)&v7->StateSubscriptionListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(&v7->StateSubscriptionListLock.PushLock, v9, &v7->StateSubscriptionListLock);
    if( v10 )
      v10[26] |= 1u;
    v11 = (VOID **)*((_QWORD *)Subscription + 8);
    if( v11[1] != (char *)Subscription + 64 )
      goto LABEL_60;
    v12 = (VOID **)*((_QWORD *)Subscription + 9);
    if( *v12 != (char *)Subscription + 64 )
      goto LABEL_60;
    *v12 = v11;
    v11[1] = v12;
    v13 = *((_DWORD *)Subscription + 25);
    *((_QWORD *)Subscription + 6) = 0i64;
    if( (v13 & 1) != 0 )
      v23 = _InterlockedExchangeAdd(&v7->DataSubscribersCount, 0xFFFFFFFF) == 1;
  }
  v14 = (VOID **)*((_QWORD *)Subscription + 3);
  if( v14[1] != (char *)Subscription + 24 )
    goto LABEL_60;
  v15 = (VOID **)*((_QWORD *)Subscription + 4);
  if( *v15 != (char *)Subscription + 24 )
    goto LABEL_60;
  *v15 = v14;
  v14[1] = v15;
  v16 = KeAbPreAcquire(&WnfContext[13], 0i64, 0i64);
  v17 = v16;
  if( _interlockedbittestandset64((volatile signed __int32 *)&WnfContext[13], 0i64) )
    ExfAcquirePushLockExclusiveEx(WnfContext + 13, v16, &WnfContext[13]);
  if( v17 )
    v17[26] |= 1u;
  v18 = *((_DWORD *)Subscription + 30);
  if( v18 != 1 && (*((PEPROCESS *)Subscription + 5) == PsInitialSystemProcess || !v18) )
    goto LABEL_25;
  v20 = (VOID **)*((_QWORD *)Subscription + 13);
  if( v20[1] != (char *)Subscription + 104
    || (v21 = (VOID **)*((_QWORD *)Subscription + 14), *v21 != (char *)Subscription + 104) )
  {
LABEL_60:
    __fastfail(3u);
  }
  *v21 = v20;
  v20[1] = v21;
  if( v7
    && (*((_BYTE *)Subscription + 100) & 1) != 0
    && ((*((_BYTE *)Subscription + 124) & 1) != 0 || (*((_BYTE *)Subscription + 128) & 1) != 0) )
  {
    LOBYTE(v8) = _InterlockedExchangeAdd(&v7->CurrentDeliveryCount, 0xFFFFFFFF) == 1;
  }
LABEL_25:
  *((_QWORD *)Subscription + 5) = 0i64;
  if( (_InterlockedExchangeAdd64(&WnfContext[13]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(WnfContext + 13);
  KeAbPostRelease(&WnfContext[13]);
  if( v7 )
  {
    v19 = 0;
    if( v23 || v8 )
    {
      if( ExAcquireRundownProtection(&v7->RunRef) )
      {
        v19 = 1;
      }
      else
      {
        v23 = 0;
        v8 = 0;
      }
    }
    if( (_InterlockedExchangeAdd64(&v7->StateSubscriptionListLock.PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&v7->StateSubscriptionListLock.PushLock);
    KeAbPostRelease(&v7->StateSubscriptionListLock);
    if( WnfContext )
    {
      if( (_InterlockedExchangeAdd64(&WnfContext[10]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(WnfContext + 10);
      KeAbPostRelease(&WnfContext[10]);
      WnfContext = 0i64;
    }
    if( v8 )
      ExpWnfNotifyNameSubscribers(v7, 8ui64, 1ui64, Process != PsInitialSystemProcess);
    if( v23 )
      ExpWnfNotifyNameSubscribers(v7, 4ui64, 1ui64, Process != PsInitialSystemProcess);
    if( v19 )
      ExReleaseRundownProtection(&v7->RunRef);
  }
LABEL_42:
  if( WnfContext )
  {
    if( (_InterlockedExchangeAdd64(&WnfContext[10]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(WnfContext + 10);
    KeAbPostRelease(&WnfContext[10]);
  }
  ExReleaseRundownProtection((_EX_RUNDOWN_REF *)Subscription + 1);
  if( v4 )
  {
    ExWaitForRundownProtectionRelease((_EX_RUNDOWN_REF *)Subscription + 1);
    ExFreePoolWithTag(Subscription, 0x20666E57u);
  }
}

Referenced by: