PsRegisterSiloMonitor

INT64 __fastcall PsRegisterSiloMonitor(INT64 a1, CHAR **a2){
  _WORD *v4; 
  _EJOB *CurrentSilo; 
  __int64 v6; 
  char *PoolWithTag; 
  char *v8; 
  UNICODE_STRING *v9; 
  int v10; 
  if( !*(_BYTE *)a1 )
    return 3221225485i64;
  v4 = *(_WORD **)(a1 + 8);
  if( !v4 || !*v4 || !*(_QWORD *)(a1 + 16) && !*(_QWORD *)(a1 + 24) )
    return 3221225485i64;
  CurrentSilo = PsGetCurrentSilo();
  if( !PsIsHostSilo(CurrentSilo) )
    return 3221225569i64;
  v6 = **(unsigned __int16 **)(a1 + 8);
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v6 + 56, 0x4D6C6953ui64);
  v8 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  memset((INT64)PoolWithTag, 0i64);
  v8[16] = *(_BYTE *)(a1 + 1);
  v8[17] = *(_BYTE *)(a1 + 2);
  *((_QWORD *)v8 + 3) = *(_QWORD *)(a1 + 16);
  *((_QWORD *)v8 + 4) = *(_QWORD *)(a1 + 24);
  *((_QWORD *)v8 + 6) = v8 + 56;
  *((_WORD *)v8 + 21) = v6;
  RtlCopyUnicodeString((UNICODE_STRING *)(v8 + 40), *(UNICODE_STRING **)(a1 + 8), v9);
  v10 = PspStorageAllocSlot((UINT64)(v8 + 20));
  if( v10 < 0 )
  {
    ExFreePoolWithTag(v8, 0x4D6C6953u);
    return(unsigned int)v10;
  }
  else
  {
    *a2 = v8;
    return 0i64;
  }
}

Referenced by: