InsertEventEntryInLookUpTable

__int64 __fastcall InsertEventEntryInLookUpTable(__int64 a1, __int128 *a2, unsigned __int8 a3, __int64 a4, char a5){
  __int64 v5; 
  unsigned __int8 v6; 
  unsigned int v7; 
  int v8; 
  volatile signed __int64 *v9; 
  _ETHREAD *CurrentThread; 
  __int64 v11; 
  __int64 v12; 
  char v13; 
  int SessionId; 
  bool v15; 
  char v16; 
  volatile signed __int64 *i; 
  INT64 v18; 
  int v19; 
  NTSTATUS v20; 
  unsigned __int8 v21; 
  signed __int64 v22; 
  __int64 v23; 
  int v24; 
  volatile signed __int64 *v25; 
  unsigned int v27; 
  unsigned int v28; 
  char v29; 
  signed __int64 v30; 
  volatile signed __int64 v31; 
  volatile LONG *v32; 
  unsigned __int8 v33; 
  unsigned int v34; 
  __int64 v35; 
  __int64 v36; 
  __int64 CurrentIrql; 
  v5 = *(_QWORD *)(a1 + 48);
  v6 = a5;
  LOBYTE(a1) = a5;
  v35 = 0i64;
  v36 = v5;
  v7 = 0;
  v8 = ComputeEventEntryHash((EVENT_DESCRIPTOR *)a1, a3, a4, (EVENT_DATA_DESCRIPTOR *)a4);
  CurrentIrql = KeGetCurrentIrql();
  if( (unsigned __int8)CurrentIrql >= 2u )
  {
    if( *(_BYTE *)(v5 + 373) )
      KeBugCheckEx(0xD1u, v5 + 280, KeGetCurrentIrql(), 1ui64, 0i64);
    ExAcquireSpinLockSharedAtDpcLevel((PEX_SPIN_LOCK)(v5 + 280));
  }
  else
  {
    if( (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) == 0 )
    {
      v34 = 0;
      v9 = (volatile signed __int64 *)(v5 + 272);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 243);
      ++*((_BYTE *)CurrentThread + 794);
      v11 = 0i64;
      if( *((_BYTE *)CurrentThread + 794) != 1 )
        KeBugCheckEx(0x192u, (ULONG_PTR)CurrentThread, v5 + 272, KeGetCurrentIrql(), 0i64);
      LOBYTE(v12) = *((_BYTE *)CurrentThread + 792);
      if( !(_BYTE)v12 )
      {
        if( !*((_BYTE *)CurrentThread + 870) )
          goto LABEL_48;
        v29 = *((_BYTE *)CurrentThread + 870);
        *((_BYTE *)CurrentThread + 870) = 0;
        LOBYTE(v12) = v29 | *((_BYTE *)CurrentThread + 792);
      }
      v13 = v12;
      _BitScanForward((unsigned int *)&v12, (unsigned __int8)v12);
      *((_BYTE *)CurrentThread + 792) = v13 & ~(1 << v12);
      v11 = *((_QWORD *)CurrentThread + 100) + 96 * v12;
      if( v11 )
      {
        if( (unsigned __int64)v9 >= 0xFFFF800000000000ui64
          && *((_BYTE *)&antNameB + (((unsigned __int64)v9 >> 39) & 0x1FF) - 256) == 1 )
        {
          SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
        }
        else
        {
          SessionId = -1;
        }
        *(_DWORD *)(v11 + 40) = SessionId;
        *(_QWORD *)(v11 + 32) = (unsigned __int64)v9 & 0x7FFFFFFFFFFFFFFCi64;
        goto LABEL_10;
      }
LABEL_48:
      _interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 0x10u);
LABEL_10:
      --*((_BYTE *)CurrentThread + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v5 + 272, &v34);
      v15 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
      if( v15 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
        KiCheckForKernelApcDelivery();
      if( _InterlockedCompareExchange64(v9, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx((UINT64 *)(v5 + 272), (VOID *)v11, (VOID *)(v5 + 272));
      if( v11 )
        *(_BYTE *)(v11 + 26) |= 1u;
      v6 = a5;
      v16 = 0;
      goto LABEL_18;
    }
    if( *(_BYTE *)(v5 + 373) )
      KeBugCheckEx(0xD1u, v5 + 280, KeGetCurrentIrql(), 1ui64, 0i64);
    ExAcquireSpinLockShared((PEX_SPIN_LOCK)(v5 + 280));
  }
  v16 = 1;
LABEL_18:
  for( i = (volatile signed __int64 *)(v5 + 8i64 * (v8 & 0x1F));
        ;
        i = (volatile signed __int64 *)((((__int64)v20 >> 63) & 0xFFFFFFFFFFFFFFF8ui64) + v18 + 32) )
  {
    if( !*i )
    {
      if( *(_DWORD *)(v5 + 256) >= 0x400u )
      {
        ++*(_DWORD *)(v5 + 316);
        v7 = -1073741789;
        goto LABEL_29;
      }
      if( !v35 )
      {
        v27 = CreateNewEventEntry(*(_BYTE *)(v5 + 373), a2, a3, a4, v6, v8, &v35);
        v7 = v27;
        if( !v35 )
        {
          if( v27 == -1073741801 )
            ++*(_DWORD *)(v5 + 320);
          else
            ++*(_DWORD *)(v5 + 324);
          goto LABEL_29;
        }
      }
      if( !_InterlockedCompareExchange64(i, v35, 0i64) )
      {
        v35 = 0i64;
        if( !_InterlockedExchangeAdd((volatile signed __int32 *)(v5 + 256), 1u) )
          EnableFlushTimer(*(_QWORD *)(v5 + 360), *(unsigned int *)(v5 + 368));
        v28 = *(_DWORD *)(v5 + 256);
        if( *(_DWORD *)(v5 + 304) < v28 )
          *(_DWORD *)(v5 + 304) = v28;
        goto LABEL_29;
      }
    }
    v18 = *i;
    v19 = *(_DWORD *)(v18 + 40);
    v20 = v8 == v19 ? CompareEventEntry(a3, a4, v18) : v8 - v19;
    if( !v20 )
      break;
  }
  if( v18 )
  {
    v21 = 2;
    if( v6 )
    {
      do
      {
        v22 = **(_QWORD **)(a4 + 16i64 * v21);
        v23 = *(_QWORD *)(v18 + 16);
        v24 = *(unsigned __int8 *)(v23 + 16i64 * v21 + 13);
        v25 = *(volatile signed __int64 **)(v23 + 16i64 * v21);
        if( v24 == 113 )
        {
          _InterlockedExchangeAdd64(v25, v22);
        }
        else if( (unsigned int)(v24 - 114) <= 1 )
        {
          do
          {
            v30 = *v25;
            if( v24 == 114 )
            {
              if( v22 >= v30 )
                break;
            }
            else if( v22 <= v30 )
            {
              break;
            }
            v31 = *v25;
          }
          while( v31 != _InterlockedCompareExchange64(v25, v22, v30) );
        }
        ++v21;
      }
      while( v21 < (unsigned int)v6 + 2 );
      v5 = v36;
    }
  }
LABEL_29:
  if( v16 )
  {
    v32 = (volatile LONG *)(v5 + 280);
    v33 = CurrentIrql;
    ExReleaseSpinLockSharedFromDpcLevel(v32);
    if( v33 < 2u )
      __writecr8(v33);
  }
  else
  {
    if( _InterlockedCompareExchange64((volatile signed __int64 *)(v5 + 272), 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((INT64 *)(v5 + 272));
    KeAbPostRelease((PVOID)(v5 + 272));
  }
  if( v35 )
    ExFreePoolWithTag(*(PVOID *)(v35 + 16), 0);
  return v7;
}

Referenced by: