ExpWnfPopulateStateData

NTSTATUS __stdcall ExpWnfPopulateStateData(_WNF_NAME_INSTANCE *NameInstance){
  unsigned __int64 bf_0; 
  unsigned int MaxStateSize; 
  UINT64 v5; 
  VOID **PoolWithTag; 
  __int64 v7; 
  NTSTATUS v8; 
  NTSTATUS v9; 
  unsigned int v10; 
  unsigned int v11; 
  _EX_RUNDOWN_REF *v12; 
  __int64(__fastcall **ExtensionTable)(__int64 *, NTSTATUS(__stdcall *)(INT64, INT64, INT64, INT64, VOID *, size_t), _WNF_NAME_INSTANCE *); 
  NTSTATUS v14; 
  UINT64 Length; 
  UINT64 ResultLength; 
  _UNICODE_STRING ValueName; 
  unsigned __int64 v18; 
  char v19; 

  bf_0 = NameInstance->StateName._bf_0;
  if( ((bf_0 >> 6) & 0xF) == 5 )
  {
    v12 = (_EX_RUNDOWN_REF *)*(&WheapDeferredInternalLogsEventLock + 53);
    v18 = bf_0 ^ 0x41C64E6DA3BC0074i64;
    ExtensionTable = (__int64(__fastcall **)(__int64 *, NTSTATUS(__stdcall *)(INT64, INT64, INT64, INT64, VOID *, size_t), _WNF_NAME_INSTANCE *))ExGetExtensionTable(*(&WheapDeferredInternalLogsEventLock + 53));
    if( ExtensionTable )
    {
      v14 = ExtensionTable[15]((__int64 *)&v18, ExpWnfPopulateStateDataRemoteCallback, NameInstance);
      ExReleaseExtensionTable(v12);
      if( v14 != -1073741822 )
      {
        if( v14 < 0 )
          return v14;
        return 0;
      }
    }
  }
  if( NameInstance->StateData || !NameInstance->PermanentDataStore )
    return 0;
  MaxStateSize = NameInstance->StateNameInfo.MaxStateSize;
  v5 = MaxStateSize + 16;
  while( 1 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v5, 543583831i64);
    if( !PoolWithTag )
      return -1073741670;
    v7 = NameInstance->StateName._bf_0;
    *(_QWORD *)&ValueName.Length = 2228224i64;
    ValueName.Buffer = (wchar_t *)&v19;
    ExpWnfComposeValueName((_WNF_STATE_NAME_STRUCT)v7, &ValueName);
    LODWORD(ResultLength) = MaxStateSize + 16;
    LODWORD(Length) = MaxStateSize + 16;
    v8 = ZwQueryValueKey(
           NameInstance->PermanentDataStore,
           &ValueName,
           KeyValuePartialInformation,
           PoolWithTag,
           Length,
           &ResultLength);
    v9 = v8;
    if( v8 == -1073741772 )
    {
      PoolWithTag[1] = 0i64;
LABEL_9:
      *(_DWORD *)PoolWithTag = 1050884;
      v10 = *((_DWORD *)PoolWithTag + 3);
      *((_DWORD *)PoolWithTag + 1) = MaxStateSize;
      NameInstance->CurrentChangeStamp = v10;
      NameInstance->StateData = (_WNF_STATE_DATA *)PoolWithTag;
      return 0;
    }
    if( v8 != -1073741789 )
      break;
    ExFreePoolWithTag(PoolWithTag, 0x20666E57u);
    v5 = (unsigned int)ResultLength;
    MaxStateSize = ResultLength - 16;
  }
  if( v8 >= 0 )
  {
    if( *((_DWORD *)PoolWithTag + 1) == 3 )
    {
      v11 = *((_DWORD *)PoolWithTag + 2);
      if( v11 >= 4 )
      {
        *((_DWORD *)PoolWithTag + 2) = v11 - 4;
        goto LABEL_9;
      }
    }
    v9 = -1073741823;
  }
  ExFreePoolWithTag(PoolWithTag, 0x20666E57u);
  return v9;
}

Referenced by: