ExpWnfCompleteThreadSubscriptions

INT64 __fastcall ExpWnfCompleteThreadSubscriptions(volatile INT32 *a1, INT64 *a2, INT64 a3, INT64 a4, INT64 a5){
  _WNF_NAME_INSTANCE *v7; 
  int v8; 
  UINT64 v9; 
  _BYTE *v10; 
  _BYTE *v11; 
  _BYTE *v12; 
  _BYTE *v13; 
  __int64 *v14; 
  int v15; 
  int v16; 
  __int64 *v17; 
  __int64 **v18; 
  int v19; 
  __int64 v20; 
  __int64 v22; 
  _WNF_STATE_NAME_STRUCT InternalStateName; 
  _WNF_NAME_INSTANCE *NameInstance; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  InternalStateName = 0i64;
  v7 = 0i64;
  v8 = a4;
  if( (int)ExpCaptureWnfStateName((const _WNF_STATE_NAME *)a2, &InternalStateName, 0) < 0 )
    return 3221225485i64;
  LODWORD(v10) = KeAbPreAcquire((PVOID)(a1 + 20), 0i64, v9);
  v11 = v10;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)a1 + 10, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx((UINT64 *)a1 + 10, v10, (VOID *)(a1 + 20));
  if( v11 )
    v11[26] |= 1u;
  LODWORD(v12) = KeAbPreAcquire((PVOID)(a1 + 26), 0i64, 0i64);
  v13 = v12;
  if( _interlockedbittestandset64(a1 + 26, 0i64) )
    ExfAcquirePushLockExclusiveEx((UINT64 *)a1 + 13, v12, (VOID *)(a1 + 26));
  if( v13 )
    v13[26] |= 1u;
  v14 = (__int64 *)*((_QWORD *)a1 + 14);
  if( v14 == (__int64 *)(a1 + 28) )
  {
LABEL_36:
    v15 = 0;
  }
  else
  {
    while( *(v14 - 11) != a3 || InternalStateName != *(v14 - 6) )
    {
      v14 = (__int64 *)*v14;
      if( v14 == (__int64 *)(a1 + 28) )
        goto LABEL_36;
    }
    v15 = 1;
    if( v8 != *((_DWORD *)v14 + 6) || *((int *)v14 + 4) <= 1 )
      goto LABEL_27;
    v16 = *((_DWORD *)v14 + 5);
    if( v16 )
    {
      *((_DWORD *)v14 + 4) = 1;
      if( (_DWORD)a5 == -1073741267 && (v16 & 1) == 0 )
        *((_DWORD *)v14 + 5) = v16 | 1;
    }
    else
    {
      if( (_DWORD)a5 )
      {
        *((_DWORD *)v14 + 4) = 3;
        v19 = 3;
      }
      else
      {
        *((_DWORD *)v14 + 4) = 0;
        v17 = (__int64 *)*v14;
        if( *(__int64 **)(*v14 + 8) != v14 || (v18 = (__int64 **)v14[1], *v18 != v14) )
          __fastfail(3u);
        *v18 = v17;
        v17[1] = (__int64)v18;
        v19 = *((_DWORD *)v14 + 4);
      }
      if( v19 == 3 )
        goto LABEL_27;
    }
    if( (*((_BYTE *)v14 + 20) & 1) == 0 && (v14[3] & 1) != 0 )
    {
      v20 = *(v14 - 7);
      if( v20 )
      {
        if( _InterlockedExchangeAdd((volatile signed __int32 *)(v20 + 164), 0xFFFFFFFF) == 1
          && ExAcquireRundownProtection((PEX_RUNDOWN_REF)(*(v14 - 7) + 8)) )
        {
          v7 = (_WNF_NAME_INSTANCE *)*(v14 - 7);
        }
      }
    }
    *((_DWORD *)v14 + 6) = 0;
  }
LABEL_27:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)a1 + 13, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)a1 + 13);
  KeAbPostRelease((PVOID)(a1 + 26));
  if( _InterlockedCompareExchange64((volatile signed __int64 *)a1 + 10, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)a1 + 10);
  KeAbPostRelease((PVOID)(a1 + 20));
  if( !v15 && (v8 & 1) != 0 )
  {
    v22 = *((_QWORD *)a1 + 1);
    NameInstance = 0i64;
    ScopeInstance = 0i64;
    ExpWnfResolveScopeInstance(
      (struct _EX_RUNDOWN_REF **)&ScopeInstance,
      v22,
      0i64,
      (*(unsigned __int64 *)&InternalStateName >> 6) & 0xF,
      0i64);
    if( (int)ExpWnfLookupNameInstance(ScopeInstance, InternalStateName, &NameInstance) >= 0 )
    {
      if( _InterlockedExchangeAdd(&NameInstance->CurrentDeliveryCount, 0xFFFFFFFF) == 1 )
        v7 = NameInstance;
      else
        ExReleaseRundownProtection(&NameInstance->RunRef);
    }
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  }
  if( v7 )
  {
    ExpWnfNotifyNameSubscribers((INT64)v7, 8ui64, 1i64, 1ui64);
    ExReleaseRundownProtection(&v7->RunRef);
  }
  return 0i64;
}

Referenced by: