NtGetCompleteWnfStateSubscription

NTSTATUS __stdcall NtGetCompleteWnfStateSubscription(
        _WNF_STATE_NAME *OldDescriptorStateName,
        UINT64 *OldSubscriptionId,
        UINT64 OldDescriptorEventMask,
        UINT64 OldDescriptorStatus,
        _WNF_DELIVERY_DESCRIPTOR *NewDeliveryDescriptor,
        UINT64 DescriptorSize){
  __int64 v7; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v9; 
  volatile INT32 *v10; 
  INT64 v12; 
  INT64 v13; 
  v7 = (__int64)OldDescriptorStateName;
  v13 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = -1073741811;
  v10 = *(volatile INT32 **)(*((_QWORD *)KeGetCurrentThread() + 23) + 2152i64);
  if( v10 )
  {
    if( !OldDescriptorStateName || !OldSubscriptionId )
      goto LABEL_11;
    if( (_DWORD)OldDescriptorEventMask && (!(_DWORD)OldDescriptorStatus || (_DWORD)OldDescriptorStatus == -1073741267) )
    {
      if( (unsigned __int64)OldDescriptorStateName >= 0x7FFFFFFF0000i64 )
        v7 = 0x7FFFFFFF0000i64;
      v13 = *(_QWORD *)v7;
      if( (unsigned __int64)OldSubscriptionId >= 0x7FFFFFFF0000i64 )
        OldSubscriptionId = (UINT64 *)0x7FFFFFFF0000i64;
      LODWORD(v12) = OldDescriptorStatus;
      v9 = ExpWnfCompleteThreadSubscriptions(v10, &v13, *OldSubscriptionId, (unsigned int)OldDescriptorEventMask, v12);
      if( v9 >= 0 )
      {
LABEL_11:
        if( (_DWORD)DescriptorSize )
        {
          if( (unsigned int)DescriptorSize < 0x1030 )
          {
            v9 = -1073741789;
          }
          else
          {
            ProbeForWrite(NewDeliveryDescriptor, (unsigned int)DescriptorSize, 8ui64);
            v9 = ExpWnfDeliverThreadNotifications(
                   (_WNF_PROCESS_CONTEXT *)v10,
                   NewDeliveryDescriptor,
                   (unsigned int)DescriptorSize);
          }
        }
      }
    }
  }
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v9;
}

Referenced by: