EtwpRegisterProvider

__int64 __fastcall EtwpRegisterProvider(
        __int64 a1,
        unsigned __int64 a2,
        int a3,
        void (__fastcall *a4)(_QWORD *, __int64, __int16 *, __int64),
        __int64 a5,
        __int64 a6,
        _QWORD *a7){
  bool v10; 
  __int64 v11; 
  void *GuidEntryByGuid; 
  _ETHREAD *v13; 
  UINT64 v14; 
  int v15; 
  _ETW_REG_ENTRY *v16; 
  INT64 v17; 
  __int64 v18; 
  EVENT_DESCRIPTOR *v19; 
  UINT64 v20; 
  _GUID *v21; 
  __int64 v22; 
  _EVENT_FILTER_HEADER *PoolWithTag; 
  unsigned int SchematizedFilterSize; 
  __int64 v26; 
  unsigned int v27; 
  _ETHREAD *CurrentThread; 
  UINT8 EnableMask; 
  _ETW_REG_ENTRY *RegEntry; 
  __int64 v31; 
  _TRACE_ENABLE_INFO EnableInfo; 
  __int16 v33; 
  char v34; 
  char v35; 
  int v36; 
  int v37; 
  int v38; 
  __int128 v39; 
  RegEntry = 0i64;
  v31 = a5;
  *a7 = 0i64;
  v11 = *(_QWORD *)a2 - SecurityProviderGuid;
  v10 = *(_QWORD *)a2 == (_QWORD)SecurityProviderGuid;
  memset(&EnableInfo, 0, sizeof(EnableInfo));
  if( v10 )
    v11 = *(_QWORD *)(a2 + 8) - *((_QWORD *)&SecurityProviderGuid + 1);
  if( !v11 )
    return 3221225506i64;
  if( !a4 && a5 || a3 != 3 && (a3 != 2 || !a4) )
    return 3221225485i64;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid((_ETW_SILODRIVERSTATE *)a1, (const _GUID *)a2, EtwTraceGuidType);
  if( GuidEntryByGuid || (GuidEntryByGuid = EtwpAddGuidEntry(a1, a2, 0i64)) != 0i64 )
  {
    if( *((_QWORD *)GuidEntryByGuid + 50) )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx(*((_QWORD *)GuidEntryByGuid + 50) + 408i64, 0i64);
      *(_QWORD *)(*((_QWORD *)GuidEntryByGuid + 50) + 416i64) = KeGetCurrentThread();
    }
    v13 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v13 + 242);
    v14 = (UINT64)GuidEntryByGuid + 408;
    ExAcquirePushLockExclusiveEx((UINT64)GuidEntryByGuid + 408, 0i64);
    *((_QWORD *)GuidEntryByGuid + 52) = KeGetCurrentThread();
    v15 = EtwpAddKmRegEntry((ULONG_PTR)GuidEntryByGuid, (__int64)&RegEntry);
    if( v15 >= 0 )
    {
      v16 = RegEntry;
      RegEntry->ReplyQueue = (_ETW_REPLY_QUEUE *)a6;
      *a7 = v16;
      if( *((_DWORD *)GuidEntryByGuid + 24) )
        EtwpUpdateEnableMask((INT64)GuidEntryByGuid, (v16->Flags & 8) != 0, 0, 0, &v16->EnableMask);
      v17 = *((_QWORD *)GuidEntryByGuid + 50);
      if( v17 && *(_DWORD *)(v17 + 96) )
        EtwpUpdateEnableMask(v17, (v16->Flags & 8) != 0, 1, 0, &v16->HostEnableMask);
      EtwpComputeRegEntryEnableInfo(v16, &EnableInfo);
      EtwpTrackProviderRegistration((INT64)v16);
      if( a4 )
      {
        if( (v16->Flags & 8) != 0 )
        {
          if( (*((_BYTE *)GuidEntryByGuid + 91) & 1) != 0 )
          {
            v33 = *((_WORD *)GuidEntryByGuid + 44);
            LOBYTE(v18) = 1;
            v34 = *((_BYTE *)GuidEntryByGuid + 90);
            v36 = *((_DWORD *)GuidEntryByGuid + 20);
            v37 = *((_DWORD *)GuidEntryByGuid + 21);
            v35 = 0;
            v38 = 0;
            a4((_QWORD *)GuidEntryByGuid + 5, v18, &v33, v31);
          }
        }
        else if( EnableInfo.IsEnabled )
        {
          RegEntry = 0i64;
          v39 = 0i64;
          PoolWithTag = 0i64;
          SchematizedFilterSize = EtwpGetSchematizedFilterSize((_ETW_GUID_ENTRY *)GuidEntryByGuid, v16->EnableMask);
          v27 = SchematizedFilterSize;
          if( SchematizedFilterSize )
          {
            PoolWithTag = (_EVENT_FILTER_HEADER *)ExAllocatePoolWithTag(
                                                    PagedPool,
                                                    SchematizedFilterSize,
                                                    0x46777445ui64);
            if( PoolWithTag )
            {
              *(_QWORD *)&v39 = PoolWithTag;
              *((_QWORD *)&v39 + 1) = v27 | 0x8000000000000000ui64;
              EnableMask = v16->EnableMask;
              RegEntry = (_ETW_REG_ENTRY *)&v39;
              EtwpCopySchematizedFilters(PoolWithTag, (_ETW_GUID_ENTRY *)GuidEntryByGuid, EnableMask);
            }
          }
          LOBYTE(v26) = EnableInfo.Level;
          ((void(__fastcall *)(GUID *, __int64, __int64, unsigned __int64, unsigned __int64, _ETW_REG_ENTRY *, __int64))a4)(
            &NullGuid,
            1i64,
            v26,
            EnableInfo.MatchAnyKeyword,
            EnableInfo.MatchAllKeyword,
            RegEntry,
            v31);
          if( PoolWithTag )
            ExFreePoolWithTag(PoolWithTag, 0);
          v14 = (UINT64)GuidEntryByGuid + 408;
        }
      }
      if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_PROVIDER_REGISTER, v19) )
        EtwpEventWriteTemplateSessAndProv(
          v20,
          (_EVENT_DESCRIPTOR *)&ETW_EVENT_PROVIDER_REGISTER,
          v21,
          1u,
          0i64,
          (_GUID *)a2);
    }
    *((_QWORD *)GuidEntryByGuid + 52) = 0i64;
    ExReleasePushLockEx(v14, 0i64);
    KeLeaveCriticalRegion();
    v22 = *((_QWORD *)GuidEntryByGuid + 50);
    if( v22 )
    {
      *(_QWORD *)(v22 + 416) = 0i64;
      ExReleasePushLockEx(*((_QWORD *)GuidEntryByGuid + 50) + 408i64, 0i64);
      KeLeaveCriticalRegion();
    }
    EtwpUnreferenceGuidEntry(GuidEntryByGuid);
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return(unsigned int)v15;
}

Referenced by: