VslGetEtwDebugId

INT64 __fastcall VslGetEtwDebugId(INT64 a1, INT64 a2, INT64 *a3, UINT64 *a4){
  void *v8; 
  int v9; 
  VOID *PoolWithTag; 
  INT64 v12[10]; 
  INT64 result[5]; 
  int v14; 
  memset((INT64)result, 0i64);
  memset((INT64)v12, 0i64);
  v8 = (void *)*a3;
  v9 = VslpLockPagesForTransfer((INT64)v12, *a3, *(unsigned int *)a4, 2i64, 0);
  if( v9 < 0 )
  {
LABEL_12:
    if( v8 != (void *)*a3 && v8 )
      ExFreePoolWithTag(v8, 0);
  }
  else
  {
    while( 1 )
    {
      result[1] = *(_QWORD *)(a1 + 992);
      result[4] = v12[7];
      result[3] = v12[0];
      result[2] = a2;
      v9 = VslpEnterIumSecureMode(2u, 17, 0i64, (INT64)result);
      VslpUnlockPagesForTransfer((INT64 **)v12);
      *(_DWORD *)a4 = v14;
      if( v9 >= 0 )
        break;
      if( v9 != -1073741789 )
        goto LABEL_10;
      if( v8 != (void *)*a3 )
        ExFreePoolWithTag(v8, 0);
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, *(unsigned int *)a4, 0x54736D56ui64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
      {
        v9 = -1073741670;
LABEL_10:
        if( v9 < 0 )
          goto LABEL_12;
        break;
      }
      v9 = VslpLockPagesForTransfer((INT64)v12, (INT64)PoolWithTag, *(unsigned int *)a4, 2i64, 0);
      if( v9 < 0 )
        goto LABEL_10;
    }
    *a3 = (INT64)v8;
  }
  return(unsigned int)v9;
}

Referenced by:

EtwpLocateDbgIdForRegEntry