ExpWnfNotifySubscription

VOID __fastcall ExpWnfNotifySubscription(INT64 a1, INT64 a2, UINT64 a3, UINT64 a4){
  UINT64 *v4; 
  unsigned int v5; 
  unsigned int v7; 
  __int64 v8; 
  _BYTE *v9; 
  __int64 v10; 
  _BYTE *v11; 
  struct _KEVENT *v12; 
  v4 = (UINT64 *)(a1 + 112);
  v5 = a3;
  v7 = a4;
  v8 = 0i64;
  LODWORD(v9) = KeAbPreAcquire((PVOID)(a1 + 112), 0i64, 0i64);
  v11 = v9;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(v4, v9, v4);
  if( v11 )
    v11[26] |= 1u;
  if( *(_QWORD *)(a2 + 48) && (unsigned int)ExpWnfInsertSubscriptionInPendingQueue(a2, v5, v10) )
    v8 = *(_QWORD *)(a2 + 40);
  if( _InterlockedCompareExchange64((volatile signed __int64 *)v4, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)v4);
  KeAbPostRelease(v4);
  if( v8 )
  {
    if( PsInitialSystemProcess == (PEPROCESS)v8 )
    {
      ExpWnfStartKernelDispatcher(v7);
    }
    else
    {
      v12 = *(struct _KEVENT **)(*(_QWORD *)(v8 + 2152) + 128i64);
      if( v12 )
        KeSetEvent(v12, 1);
    }
  }
}

Referenced by: