ExEnableHandleTracing

NTSTATUS __stdcall ExEnableHandleTracing(_HANDLE_TABLE *HandleTable, UINT64 Slots){
  unsigned int v2; 
  int i; 
  unsigned __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  NTSTATUS result; 
  _EPROCESS *QuotaProcess; 
  _HANDLE_TRACE_DEBUG_INFO *PoolWithTag; 
  _HANDLE_TRACE_DEBUG_INFO *v11; 
  _ETHREAD *CurrentThread; 
  _HANDLE_TRACE_DEBUG_INFO *DebugInfo; 
  v2 = Slots;
  if( (_DWORD)Slots )
  {
    if( (unsigned int)Slots >= ExHandleTraceDbMinStacks )
    {
      if( (unsigned int)Slots > ExHandleTraceDbMaxStacks )
        v2 = ExHandleTraceDbMaxStacks;
    }
    else
    {
      v2 = ExHandleTraceDbMinStacks;
    }
    for( i = v2 - 1; (i & v2) != 0; v2 = i + 1 )
      i = v2 | (v2 - 1);
  }
  else
  {
    v2 = *(_DWORD *)ExHandleTraceDbDefaultStacks;
  }
  v5 = 160i64 * v2 + 80;
  MmGetMaximumNonPagedPoolInBytes((INT64)HandleTable, _InterlockedExchangeAdd(&ExpTotalTraceBuffers, v2));
  if( 160 * v7 > (unsigned __int64)(5 * v6) >> 4 )
  {
    result = -1073741670;
LABEL_14:
    _InterlockedExchangeAdd(&ExpTotalTraceBuffers, -v2);
    return result;
  }
  QuotaProcess = HandleTable->QuotaProcess;
  if( QuotaProcess )
  {
    result = PsChargeProcessNonPagedPoolQuota((__int64)HandleTable->QuotaProcess, v5);
    if( result < 0 )
      goto LABEL_14;
  }
  PoolWithTag = (_HANDLE_TRACE_DEBUG_INFO *)ExAllocatePoolWithTag(NonPagedPoolNx, v5, 0x6474624Fui64);
  v11 = PoolWithTag;
  if( !PoolWithTag )
  {
    _InterlockedExchangeAdd(&ExpTotalTraceBuffers, -v2);
    if( QuotaProcess )
      PsReturnProcessNonPagedPoolQuota((ULONG_PTR)QuotaProcess, v5);
    return -1073741670;
  }
  memset((INT64)PoolWithTag, 0i64);
  v11->TableSize = v2;
  v11->RefCount = 1;
  v11->CloseCompactionLock.Owner = 0i64;
  v11->CloseCompactionLock.Contention = 0;
  v11->CloseCompactionLock.Count = 1;
  KeInitializeEvent(&v11->CloseCompactionLock.Event, SynchronizationEvent, 0);
  if( QuotaProcess )
    LOBYTE(HandleTable->Flags) |= 1u;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&HandleTable->HandleTableLock, 0i64);
  DebugInfo = HandleTable->DebugInfo;
  HandleTable->DebugInfo = v11;
  if( DebugInfo )
  {
    if( (DebugInfo->BitMaskFlags & 8) == 0 )
      goto LABEL_26;
    goto LABEL_25;
  }
  if( (HandleTable->Flags & 2) != 0 )
LABEL_25:
    v11->BitMaskFlags = 8;
LABEL_26:
  LOBYTE(HandleTable->Flags) |= 2u;
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&HandleTable->HandleTableLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&HandleTable->HandleTableLock);
  KeAbPostRelease(&HandleTable->HandleTableLock);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( DebugInfo )
    ExDereferenceHandleDebugInfo(HandleTable, DebugInfo);
  return 0;
}

Referenced by: