ExpWnfDeliverThreadNotifications

INT64 __fastcall ExpWnfDeliverThreadNotifications(
        _WNF_PROCESS_CONTEXT *ProcessContext,
        _WNF_DELIVERY_DESCRIPTOR *NewDeliveryDescriptor,
        UINT64 DescriptorSize){
  _WNF_PROCESS_CONTEXT *v3; 
  unsigned int v4; 
  INT64 *p_ProcessSubscriptionListLock; 
  _BYTE *v6; 
  _BYTE *v7; 
  volatile INT64 *p_DeliveryPendingListLock; 
  _BYTE *v9; 
  _BYTE *v10; 
  __int64 p_DeliveryPendingListHead; 
  __int64 Flink; 
  signed __int64 v13; 
  int *v14; 
  unsigned int v15; 
  _WNF_DELIVERY_DESCRIPTOR *v16; 
  _WNF_TYPE_ID *v17; 
  __int64 **v19; 
  __int64 v20; 
  __int64 *v21; 
  int v22; 
  _WNF_LOCK *v23; 
  _WNF_LOCK *v24; 
  int v25; 
  UINT64 DataSize; 
  _LIST_ENTRY *v27; 
  __int64 v28; 
  int *v29; 
  _DWORD *v30; 
  PVOID Lock; 
  PVOID v32; 
  __int64 *v33; 
  int v36; 
  UINT64 ChangeStamp; 
  v3 = ProcessContext;
  LODWORD(DataSize) = 0;
  v4 = -2147483622;
  v36 = -2147483622;
  v25 = 0;
  LODWORD(ChangeStamp) = 0;
  HIDWORD(DataSize) = DescriptorSize - 48;
LABEL_2:
  p_ProcessSubscriptionListLock = (INT64 *)&v3->ProcessSubscriptionListLock;
  v32 = &v3->ProcessSubscriptionListLock;
  LODWORD(v6) = KeAbPreAcquire(&v3->ProcessSubscriptionListLock, 0i64, 0i64);
  v7 = v6;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&v3->ProcessSubscriptionListLock, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx((UINT64 *)&v3->ProcessSubscriptionListLock, v6, &v3->ProcessSubscriptionListLock);
  if( v7 )
    v7[26] |= 1u;
  p_DeliveryPendingListLock = (volatile INT64 *)&v3->DeliveryPendingListLock;
  Lock = &v3->DeliveryPendingListLock;
  LODWORD(v9) = KeAbPreAcquire(&v3->DeliveryPendingListLock, 0i64, 0i64);
  v10 = v9;
  if( _interlockedbittestandset64((volatile signed __int32 *)&v3->DeliveryPendingListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx((UINT64 *)&v3->DeliveryPendingListLock, v9, &v3->DeliveryPendingListLock);
  if( v10 )
    v10[26] |= 1u;
  p_DeliveryPendingListHead = (__int64)&v3->DeliveryPendingListHead;
  v27 = &v3->DeliveryPendingListHead;
  Flink = (__int64)v3->DeliveryPendingListHead.Flink;
  while( 1 )
  {
    v33 = (__int64 *)Flink;
    if( Flink == p_DeliveryPendingListHead )
      break;
    v30 = (_DWORD *)(Flink + 16);
    if( *(_DWORD *)(Flink + 16) != 1 )
      goto LABEL_36;
    v13 = *(_QWORD *)(Flink - 56);
    v28 = v13;
    if( v13 )
    {
      v13 &= -(__int64)ExAcquireRundownProtection((PEX_RUNDOWN_REF)(v13 + 8));
      v28 = v13;
    }
    v14 = (int *)(Flink + 20);
    v29 = (int *)(Flink + 20);
    v15 = *(_DWORD *)(Flink + 20) & *(_DWORD *)(Flink - 4) & 0xFFFFFFFE;
    if( v13 )
      v15 = *(_DWORD *)(Flink + 20) & *(_DWORD *)(Flink - 4);
    if( !v15 )
      goto LABEL_40;
    v16 = NewDeliveryDescriptor;
    *(_OWORD *)&NewDeliveryDescriptor->SubscriptionId = 0i64;
    *(_OWORD *)&NewDeliveryDescriptor->ChangeStamp = 0i64;
    *(_OWORD *)&NewDeliveryDescriptor->TypeId.TypeId.Data2 = 0i64;
    NewDeliveryDescriptor->StateName = (_WNF_STATE_NAME)(*(_QWORD *)(Flink - 48) ^ 0x41C64E6DA3BC0074i64);
    NewDeliveryDescriptor->SubscriptionId = *(_QWORD *)(Flink - 88);
    if( (v15 & 1) != 0 )
    {
      v17 = *(_WNF_TYPE_ID **)(v13 + 64);
      if( v17 )
        NewDeliveryDescriptor->TypeId = *v17;
      v25 = ExpWnfReadStateData(
              (_WNF_NAME_INSTANCE *)v13,
              &ChangeStamp,
              &NewDeliveryDescriptor[1],
              HIDWORD(DataSize),
              &DataSize);
      if( v25 < 0 )
        goto LABEL_24;
      v16 = NewDeliveryDescriptor;
      NewDeliveryDescriptor->ChangeStamp = ChangeStamp;
      NewDeliveryDescriptor->StateDataSize = DataSize;
    }
    v16->StateDataOffset = 48;
    v16->EventMask = v15;
LABEL_24:
    if( v13 )
    {
      ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v13 + 8));
      v13 = 0i64;
    }
    if( v25 < 0 )
    {
      v4 = v36;
      if( v36 == -2147483622 )
      {
        v4 = v25;
        v36 = v25;
      }
      goto LABEL_36;
    }
    if( !(_DWORD)ChangeStamp )
      v15 &= ~1u;
    if( v15 )
    {
      *(_DWORD *)(Flink + 24) = v15;
      *v29 = 0;
      *v30 = 2;
      v4 = 0;
      break;
    }
    v14 = v29;
LABEL_40:
    v19 = *(__int64 ***)(Flink + 8);
    Flink = (__int64)v19;
    v20 = (__int64)v33;
    v21 = (__int64 *)*v33;
    if( *(__int64 **)(*v33 + 8) != v33 || *v19 != v33 )
      __fastfail(3u);
    *v19 = v21;
    v21[1] = (__int64)v19;
    *v30 = 0;
    v22 = *v14;
    *v14 = 0;
    *(_DWORD *)(v20 + 24) = 0;
    if( v13 )
    {
      if( (v22 & 1) != 0 && _InterlockedExchangeAdd((volatile signed __int32 *)(v13 + 164), 0xFFFFFFFF) == 1 )
      {
        v23 = &ProcessContext->DeliveryPendingListLock;
        if( (_InterlockedExchangeAdd64(
                (volatile signed __int64 *)&ProcessContext->DeliveryPendingListLock,
                0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)v23);
        KeAbPostRelease(v23);
        v24 = &ProcessContext->ProcessSubscriptionListLock;
        if( _InterlockedCompareExchange64(
               (volatile signed __int64 *)&ProcessContext->ProcessSubscriptionListLock,
               0i64,
               17i64) != 17 )
          ExfReleasePushLockShared((INT64 *)v24);
        KeAbPostRelease(v24);
        ExpWnfNotifyNameSubscribers(v13, 8ui64, 1i64, 1ui64);
        ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v13 + 8));
        v4 = v36;
        v3 = ProcessContext;
        goto LABEL_2;
      }
      ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v13 + 8));
    }
    v4 = v36;
LABEL_36:
    Flink = *(_QWORD *)Flink;
    p_DeliveryPendingListHead = (__int64)v27;
  }
  if( (_InterlockedExchangeAdd64(p_DeliveryPendingListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(p_DeliveryPendingListLock);
  KeAbPostRelease((PVOID)p_DeliveryPendingListLock);
  if( _InterlockedCompareExchange64(p_ProcessSubscriptionListLock, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(p_ProcessSubscriptionListLock);
  KeAbPostRelease(p_ProcessSubscriptionListLock);
  return v4;
}

Referenced by: