PnpInitializeNotifyEntry

__int64 __fastcall PnpInitializeNotifyEntry(
        __int64 a1,
        int a2,
        unsigned __int64 a3,
        __int64 a4,
        __int64 a5,
        __int64 a6){
  PVOID v7; 
  int SessionId; 
  NTSTATUS v12; 
  struct _ERESOURCE *PoolWithTag; 
  WCHAR v15; 
  PVOID SessionHandle; 
  struct _UNICODE_STRING DestinationString; 
  OBJECT_ATTRIBUTES ObjectAttributes; 
  wchar_t Dst[256]; 
  v7 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  SessionHandle = 0i64;
  SessionId = 0;
  v12 = 0;
  DestinationString = 0i64;
  if( !(unsigned int)MmIsSessionAddress((PVOID)a3) )
    goto LABEL_2;
  SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
  if( SessionId == -1 )
    return(unsigned int)-1073741811;
  swprintf_s(Dst, 0x100ui64, (WCHAR *)L"\\KernelObjects\\Session%d");
  RtlInitUnicodeString(&DestinationString, Dst, v15);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v12 = ZwOpenSession(&SessionHandle, 0i64, &ObjectAttributes);
  if( v12 < 0 || (v7 = SessionHandle) == 0i64 )
  {
    return(unsigned int)-1073741811;
  }
  else
  {
LABEL_2:
    *(_QWORD *)(a1 + 48) = a5;
    *(_QWORD *)(a1 + 8) = a1;
    *(_WORD *)(a1 + 56) = 1;
    *(_QWORD *)(a1 + 64) = a6;
    *(_QWORD *)a1 = a1;
    *(_DWORD *)(a1 + 16) = a2;
    *(_DWORD *)(a1 + 20) = SessionId;
    *(_QWORD *)(a1 + 24) = v7;
    *(_QWORD *)(a1 + 32) = a3;
    *(_QWORD *)(a1 + 40) = a4;
    *(_BYTE *)(a1 + 58) = 0;
    PoolWithTag = (struct _ERESOURCE *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x68ui64, 0x56706E50ui64);
    *(_QWORD *)(a1 + 72) = PoolWithTag;
    if( PoolWithTag )
      ExInitializeResourceLite(PoolWithTag);
    else
      return(unsigned int)-1073741670;
  }
  return(unsigned int)v12;
}

Referenced by: