EtwpQueueNotification

INT64 __fastcall EtwpQueueNotification(
        _EPROCESS *Process,
        _ETWP_NOTIFICATION_HEADER *DataBlock,
        _ETW_REG_ENTRY *RegEntry){
  int v3; 
  __int64 v5; 
  char v8; 
  CHAR *v9; 
  _OWORD *PoolWithTag; 
  CHAR **v11; 
  _ETHREAD *CurrentThread; 
  CHAR *v13; 
  CHAR *v14; 
  CHAR **v15; 
  struct _KEVENT *v16; 
  void *ReplyObject; 
  unsigned int v19; 
  bool v20; 
  v3 = 0;
  v5 = RegEntry->Flags & 0x100;
  v8 = 1;
  v20 = (RegEntry->Flags & 0x100) != 0;
  v9 = EtwpAddDataSource((INT64)Process);
  if( v9
    && (PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x38ui64, 0x72777445ui64),
        (v11 = (CHAR **)PoolWithTag) != 0i64) )
  {
    *PoolWithTag = 0i64;
    PoolWithTag[1] = 0i64;
    PoolWithTag[2] = 0i64;
    *((_QWORD *)PoolWithTag + 6) = 0i64;
    *((_QWORD *)PoolWithTag + 2) = DataBlock;
    *((_QWORD *)PoolWithTag + 3) = RegEntry;
    *((_WORD *)PoolWithTag + 24) = RegEntry->Index;
    *((_DWORD *)PoolWithTag + 13) = 1;
    if( !DataBlock->ReplyRequested )
      goto LABEL_4;
    ReplyObject = DataBlock->ReplyObject;
    *((_DWORD *)PoolWithTag + 13) |= 2u;
    ObfReferenceObject(ReplyObject);
    v11[4] = (CHAR *)ReplyObject;
    v11[5] = (CHAR *)PsChargeProcessWakeCounter((INT64)Process, 1i64, 3i64, (INT64)RegEntry);
    v19 = 0;
    v3 = -1073741823;
    while( _InterlockedCompareExchange64(
              (volatile signed __int64 *)&RegEntry->ReplyQueue + v19,
              (signed __int64)v11,
              0i64) )
    {
      if( ++v19 >= 4 )
        goto LABEL_18;
    }
    *((_WORD *)v11 + 25) = v19;
    v3 = 0;
LABEL_18:
    if( v3 < 0 )
    {
      EtwpReleaseQueueEntry(v11, 3);
    }
    else
    {
LABEL_4:
      _InterlockedIncrement(&DataBlock->RefCount);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)(v9 + 16), 0i64);
      v13 = v9 + 24;
      v14 = (CHAR *)*((_QWORD *)v9 + 3);
      if( v14 != v9 + 24 )
      {
        while( v20 != (*(_BYTE *)(*((_QWORD *)v14 + 3) + 99i64) & 1) )
        {
          v14 = *(CHAR **)v14;
          if( v14 == v13 )
            goto LABEL_5;
        }
        v8 = 0;
      }
LABEL_5:
      v15 = (CHAR **)*((_QWORD *)v9 + 4);
      if( *v15 != v13 )
        __fastfail(3u);
      *v11 = v13;
      v11[1] = (CHAR *)v15;
      *v15 = (CHAR *)v11;
      *((_QWORD *)v9 + 4) = v11;
      if( v8 )
      {
        if( (_WORD)v5 )
          v16 = (struct _KEVENT *)*((_QWORD *)v9 + 1);
        else
          v16 = *(struct _KEVENT **)v9;
        if( v16 )
          KeSetEvent(v16, 1);
      }
      ExReleasePushLockEx((UINT64)(v9 + 16), 0i64);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    }
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return(unsigned int)v3;
}

Referenced by: