IoRegisterIoTracking

NTSTATUS __fastcall IoRegisterIoTracking(INT64 a1, INT64 *a2){
  VOID **PoolWithTag; 
  VOID **v5; 
  NTSTATUS result; 
  _ETHREAD *CurrentThread; 
  VOID ***v8; 

  *a2 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x18ui64, 1918136137i64);
  v5 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  *(_OWORD *)PoolWithTag = 0i64;
  PoolWithTag[2] = 0i64;
  PoolWithTag[2] = *(VOID **)(a1 + 8);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C452E0 + 206, 0i64);
  v8 = (VOID ***)*(&stru_140C452E0 + 211);
  if( (_UNKNOWN *)**(&stru_140C452E0 + 211) != (_UNKNOWN *)((char *)&stru_140C452E0 + 1680) )
    __fastfail(3u);
  *v5 = (char *)&stru_140C452E0 + 1680;
  v5[1] = v8;
  *v8 = v5;
  *(&stru_140C452E0 + 211) = v5;
  if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C452E0 + 206, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C452E0 + 206);
  KeAbPostRelease((char *)&stru_140C452E0 + 1648);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  IopIrpExtensionControl(2ui64, 1ui64);
  IoPerfInit(2ui64);
  result = 0;
  *a2 = (INT64)v5;
  return result;
}

Referenced by: