EtwpTrackDecodeGuidForSession

BOOL __stdcall EtwpTrackDecodeGuidForSession(INT64 a1, INT64 a2){
  __int64 v2; 
  _EX_PUSH_LOCK *v3; 
  __int64 v4; 
  bool v6; 
  _QWORD *i; 
  __int64 v8; 
  unsigned int v9; 
  VOID **PoolWithTag; 
  __int128 v11; 
  __int64 v13; 

  v2 = *(_QWORD *)(a2 + 104);
  v3 = (_EX_PUSH_LOCK *)(a1 + 704);
  v4 = *(_QWORD *)(a2 + 32);
  v6 = 0;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(a1 + 704), 0i64);
  for( i = *(_QWORD **)(a1 + 128); ; i = (_QWORD *)*i )
  {
    if( !i )
    {
      v9 = *(_DWORD *)(a1 + 340) + 2048;
      if( v9 <= *(_DWORD *)(a1 + 4) && v9 <= 0x10000 )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x30ui64, 1651995717i64);
        if( PoolWithTag )
        {
          *PoolWithTag = *(VOID **)(a1 + 128);
          *(_OWORD *)(PoolWithTag + 1) = *(_OWORD *)(v2 + 34);
          v11 = *(_OWORD *)(v4 + 40);
          *((_BYTE *)PoolWithTag + 40) = 0;
          *(_OWORD *)(PoolWithTag + 3) = v11;
          ++*(_DWORD *)(a1 + 136);
          *(_DWORD *)(a1 + 340) += 32;
          *(_QWORD *)(a1 + 128) = PoolWithTag;
          _InterlockedOr((volatile signed __int32 *)(a1 + 836), 0x8C0u);
          v6 = 1;
        }
      }
      goto LABEL_11;
    }
    v8 = *(_QWORD *)(v2 + 34) - i[1];
    if( !v8 )
      v8 = *(_QWORD *)(v2 + 42) - i[2];
    if( !v8 )
      break;
  }
  v13 = *(_QWORD *)(v4 + 40) - i[3];
  if( !v13 )
    v13 = *(_QWORD *)(v4 + 48) - i[4];
  v6 = v13 == 0;
LABEL_11:
  if( (_InterlockedExchangeAdd64(&v3->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v3);
  KeAbPostRelease(v3);
  return v6;
}

Referenced by: