IoWMIWriteEvent

NTSTATUS __stdcall IoWMIWriteEvent(VOID *WnodeEventItem){
  NTSTATUS v1; 
  int v3; 
  _LIST_ENTRY *PoolWithTag; 
  unsigned int v5; 
  unsigned __int64 v6; 
  VOID **RegEntryByProviderId; 
  _LIST_ENTRY *v8; 
  NTSTATUS result; 
  int v10; 
  int v11; 
  _KSPIN_LOCK *v12; 

  v1 = 0;
  if( !*(&ExBootDevicesRemovedEvent + 391) )
    return -1073741823;
  v3 = *((_DWORD *)WnodeEventItem + 11);
  if( (v3 & 0x60000) != 0 )
  {
    v10 = *(_DWORD *)WnodeEventItem;
    v11 = v3 & 0x20000;
    v12 = (_KSPIN_LOCK *)*((unsigned __int16 *)WnodeEventItem + 4);
    if( (unsigned int)v10 < 0x30 )
      return -1073741789;
    if( v11 )
    {
      if( (unsigned int)v10 <= 0xFFFF )
        goto LABEL_15;
    }
    else if( v10 >= 0 )
    {
LABEL_15:
      result = EtwTraceEvent(v12, (unsigned __int16 *)WnodeEventItem, 0x30u, -1072431104, 0);
      if( v11 )
        return result;
      goto LABEL_3;
    }
    return -2147483643;
  }
LABEL_3:
  PoolWithTag = (_LIST_ENTRY *)ExAllocatePoolWithTag(0x200ui64, 0x20ui64, 2003397975i64);
  if( !PoolWithTag )
    return -1073741670;
  v5 = *((_DWORD *)WnodeEventItem + 1);
  v6 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)&ExBootDevicesRemovedEvent + 436);
  RegEntryByProviderId = WmipDoFindRegEntryByProviderId(v5);
  v8 = (_LIST_ENTRY *)RegEntryByProviderId;
  if( RegEntryByProviderId )
    _InterlockedIncrement((volatile signed __int32 *)RegEntryByProviderId + 12);
  KxReleaseSpinLock((UINT64 *)&ExBootDevicesRemovedEvent + 436);
  __writecr8(v6);
  *((_DWORD *)WnodeEventItem + 10) = *((_DWORD *)WnodeEventItem + 2);
  PoolWithTag[1].Flink = v8;
  PoolWithTag[1].Blink = (_LIST_ENTRY *)WnodeEventItem;
  ExInterlockedInsertTailList(
    (PLIST_ENTRY)&stru_140C00F40 + 472,
    PoolWithTag,
    (PKSPIN_LOCK)&ExBootDevicesRemovedEvent + 396);
  if( _InterlockedIncrement((_DWORD *)&ExBootDevicesRemovedEvent + 794) == 1 )
    ExQueueWorkItem((PWORK_QUEUE_ITEM)&ExBootDevicesRemovedEvent + 98, DelayedWorkQueue);
  return v1;
}

Referenced by: