SLGetSubscriptionPfn

INT64 __fastcall SLGetSubscriptionPfn(INT64 a1, VOID **a2){
  unsigned int v4; 
  void *v5; 
  unsigned int v7; 
  INT64 *v8; 
  INT64 *v9; 
  _OWORD *PoolWithTag; 
  __int64 v11; 
  UINT64 a5; 
  unsigned int v13; 
  PVOID P; 
  _ETHREAD *CurrentThread; 
  __int64 *v16; 
  SIZE_T NumberOfBytes; 
  _ETHREAD *v18; 
  v16 = &v11;
  v13 = 0;
  P = 0i64;
  v4 = 0;
  LODWORD(NumberOfBytes) = 0;
  if( *(_BYTE *)(a1 + 46856) )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v9 = (INT64 *)(a1 + 46840);
    ExAcquirePushLockSharedEx(a1 + 46840, 0i64);
    if( *(_BYTE *)(a1 + 46856) )
    {
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x82ui64, 0x20534C53ui64);
      P = PoolWithTag;
      if( !PoolWithTag )
      {
        v13 = -1073741595;
        local_unwind(v16, &loc_14094E004);
      }
      *PoolWithTag = *(_OWORD *)(a1 + 46858);
      PoolWithTag[1] = *(_OWORD *)(a1 + 46874);
      PoolWithTag[2] = *(_OWORD *)(a1 + 46890);
      PoolWithTag[3] = *(_OWORD *)(a1 + 46906);
      PoolWithTag[4] = *(_OWORD *)(a1 + 46922);
      PoolWithTag[5] = *(_OWORD *)(a1 + 46938);
      PoolWithTag[6] = *(_OWORD *)(a1 + 46954);
      PoolWithTag[7] = *(_OWORD *)(a1 + 46970);
      *((_WORD *)PoolWithTag + 64) = *(_WORD *)(a1 + 46986);
    }
    if( _InterlockedCompareExchange64(v9, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v9);
    v8 = v9;
  }
  else
  {
    LODWORD(a5) = 0;
    v13 = sub_1403B8E0C(a1, &qword_140983CB0, 0i64, 0i64, a5, &NumberOfBytes);
    if( v13 == -1073741789 )
    {
      v4 = NumberOfBytes;
      v5 = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x20534C53ui64);
      P = v5;
      if( !v5 || v4 > 0x82 )
      {
        v13 = -1073741595;
        goto LABEL_7;
      }
      LODWORD(a5) = v4;
      v13 = sub_1403B8E0C(a1, &qword_140983CB0, 0i64, (UINT8 *)v5, a5, &NumberOfBytes);
    }
    v18 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v18 + 242);
    ExAcquirePushLockExclusiveEx(a1 + 46840, 0i64);
    if( !*(_BYTE *)(a1 + 46856) )
    {
      v7 = v13;
      if( (v13 & 0x80000000) == 0 )
        memmove((UINT8 *)(a1 + 46858), (UINT8 *)P, v4);
      if( (int)(v7 + 0x80000000) < 0 || v7 == -1073741772 )
        *(_BYTE *)(a1 + 46856) = 1;
    }
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 46840), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)(a1 + 46840));
    v8 = (INT64 *)(a1 + 46840);
  }
  KeAbPostRelease(v8);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  *a2 = P;
  P = 0i64;
LABEL_7:
  if( P )
    ExFreePoolWithTag(P, 0);
  return v13;
}

Referenced by: