ExpWnfNotifyNameSubscribers

VOID __fastcall ExpWnfNotifyNameSubscribers(INT64 a1, UINT64 a2, INT64 a3, UINT64 a4){
  UINT64 *v4; 
  int v5; 
  unsigned int v6; 
  int v8; 
  unsigned int v9; 
  int v10; 
  _BYTE *v11; 
  _BYTE *v12; 
  _QWORD *v13; 
  _QWORD *v14; 
  int inserted; 
  __int64 v16; 
  unsigned int v17; 
  struct _KEVENT *v18; 
  int v20; 
  unsigned int Synchronous; 
  Synchronous = a4;
  v20 = a3;
  v4 = (UINT64 *)(a1 + 112);
  v5 = a3;
  v6 = a2;
  v8 = 0;
  v9 = 1;
  v10 = 1;
  LODWORD(v11) = KeAbPreAcquire((PVOID)(a1 + 112), 0i64, 0i64);
  v12 = v11;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(v4, v11, v4);
  if( v12 )
    v12[26] |= 1u;
  v13 = (_QWORD *)(a1 + 120);
  v14 = (_QWORD *)*v13;
  if( (_QWORD *)*v13 != v13 )
  {
    do
    {
      if( v10 && (*((_BYTE *)v14 + 36) & 1) != 0 )
        v10 = 0;
      inserted = ExpWnfInsertSubscriptionInPendingQueue(v14 - 8, v6, 0i64);
      v16 = *(v14 - 3);
      if( inserted )
      {
        if( (PEPROCESS)v16 == PsInitialSystemProcess )
        {
          v8 = 1;
        }
        else
        {
          v18 = *(struct _KEVENT **)(*(_QWORD *)(v16 + 2152) + 128i64);
          if( v18 )
            KeSetEvent(v18, 1);
        }
      }
      v14 = (_QWORD *)*v14;
    }
    while( v14 != v13 );
    v5 = v20;
  }
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)v4);
  KeAbPostRelease(v4);
  if( v10 && (v6 & 1) != 0 )
  {
    if( v8 || !v5 )
      v9 = 0;
    v17 = Synchronous;
    ExpWnfNotifyNameSubscribers(a1, 8ui64, v9, Synchronous);
  }
  else
  {
    v17 = Synchronous;
  }
  if( v8 )
  {
    if( v5 )
      ExpWnfStartKernelDispatcher(v17);
  }
}

Referenced by: