HdlspAddLogEntry

VOID __stdcall HdlspAddLogEntry(WCHAR *String){
  __int64 v2; 
  void *v3; 
  __int64 v4; 
  int v5; 
  VOID **PoolWithTag; 
  VOID **v7; 
  unsigned __int8 v8; 
  __int64 v9; 
  __int16 v10; 
  __int64 v11; 
  unsigned __int16 v12; 
  wchar_t *v13; 
  NTSTATUS v14; 
  __int64 v15; 
  __int64 v16; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 

  v2 = -1i64;
  v3 = 0i64;
  v17 = 0i64;
  v18 = 0i64;
  v19 = 0i64;
  do
    ++v2;
  while( String[v2] );
  v4 = 2 * v2 + 2;
  if( KeGetCurrentIrql() < 2u )
  {
    ZwQuerySystemInformation();
    if( v5 < 0 )
    {
      v17 = 0i64;
      v18 = 0i64;
      v19 = 0i64;
    }
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v4, 1936483400i64);
    v7 = PoolWithTag;
    if( PoolWithTag )
      memmove(PoolWithTag, String, v4);
    if( (*(_DWORD *)(*(&stru_140CF2E80 + 920) + 48i64) & 2) != 0 )
      v8 = -1;
    else
      v8 = KeAcquireSpinLockRaiseToDpc(*(&stru_140CF2E80 + 920));
    v9 = *(&stru_140CF2E80 + 920);
    v10 = *(_WORD *)(*(&stru_140CF2E80 + 920) + 96i64);
    *(_DWORD *)(*(&stru_140CF2E80 + 920) + 48i64) |= 4u;
    v11 = *(unsigned __int16 *)(v9 + 98);
    v12 = (unsigned __int8)(v10 + 1);
    *(_WORD *)(v9 + 96) = v12;
    if( v12 == (_WORD)v11 )
    {
      v13 = *(wchar_t **)(56 * v11 + *(_QWORD *)(v9 + 16) + 48);
      v14 = wcscmp(v13, (PWCHAR)L"Entry could not be recorded due to lack of memory.\n");
      *(_WORD *)(v9 + 98) = (unsigned __int8)(v11 + 1);
      v3 = (void *)((unsigned __int64)v13 & -(__int64)(v14 != 0));
    }
    else if( (_WORD)v11 == 0xFFFF )
    {
      *(_WORD *)(v9 + 98) = 0;
    }
    v15 = 56i64 * v12;
    v16 = *(_QWORD *)(v9 + 16);
    *(_OWORD *)(v15 + v16) = v17;
    *(_OWORD *)(v15 + v16 + 16) = v18;
    *(_OWORD *)(v15 + v16 + 32) = v19;
    if( v7 )
      *(_QWORD *)(56i64 * *(unsigned __int16 *)(*(&stru_140CF2E80 + 920) + 96i64)
                + *(_QWORD *)(*(&stru_140CF2E80 + 920) + 16i64)
                + 48) = v7;
    else
      *(_QWORD *)(56i64 * *(unsigned __int16 *)(*(&stru_140CF2E80 + 920) + 96i64)
                + *(_QWORD *)(*(&stru_140CF2E80 + 920) + 16i64)
                + 48) = L"Entry could not be recorded due to lack of memory.\n";
    if( v8 != 0xFF )
    {
      KxReleaseSpinLock(*(&stru_140CF2E80 + 920));
      __writecr8(v8);
    }
    if( v3 )
      ExFreePoolWithTag(v3, 0);
  }
}

Referenced by: