ExpWnfAcquireSubscriptionByName

INT64 __fastcall ExpWnfAcquireSubscriptionByName(
        _WNF_STATE_NAME_STRUCT StateName,
        _WNF_PROCESS_CONTEXT *ProcessContext,
        _WNF_SUBSCRIPTION **Subscription){
  _WNF_LOCK *p_ProcessSubscriptionListLock; 
  _BYTE *v7; 
  _BYTE *v8; 
  _WNF_PROCESS_CONTEXT *i; 
  _WNF_SUBSCRIPTION *p_DeliveryPendingListHead; 
  INT64 result; 
  p_ProcessSubscriptionListLock = &ProcessContext->ProcessSubscriptionListLock;
  LODWORD(v7) = KeAbPreAcquire(&ProcessContext->ProcessSubscriptionListLock, 0i64, 0i64);
  v8 = v7;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)p_ProcessSubscriptionListLock, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx((UINT64 *)p_ProcessSubscriptionListLock, v7, p_ProcessSubscriptionListLock);
  if( v8 )
    v8[26] |= 1u;
  for( i = (_WNF_PROCESS_CONTEXT *)ProcessContext->ProcessSubscriptionListHead.Flink;
        i != (_WNF_PROCESS_CONTEXT *)&ProcessContext->ProcessSubscriptionListHead;
        i = *(_WNF_PROCESS_CONTEXT **)&i->Header.NodeTypeCode )
  {
    p_DeliveryPendingListHead = (_WNF_SUBSCRIPTION *)&i[-1].DeliveryPendingListHead;
    if( i->ImplicitScopeInstances[0] == *(void **)&StateName )
    {
      ExAcquireRundownProtection(&p_DeliveryPendingListHead->RunRef);
      if( _InterlockedCompareExchange64((volatile signed __int64 *)p_ProcessSubscriptionListLock, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)p_ProcessSubscriptionListLock);
      KeAbPostRelease(p_ProcessSubscriptionListLock);
      result = 0i64;
      *Subscription = p_DeliveryPendingListHead;
      return result;
    }
  }
  if( _InterlockedCompareExchange64((volatile signed __int64 *)p_ProcessSubscriptionListLock, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)p_ProcessSubscriptionListLock);
  KeAbPostRelease(p_ProcessSubscriptionListLock);
  return 3221225524i64;
}

Referenced by: