PfSnBeginTrace

__int64 __fastcall PfSnBeginTrace(_OWORD *a1, int a2, void *a3, _ETHREAD *a4, int a5, __int64 *a6){
  __int64 v8; 
  VOID *PoolWithTag; 
  INT64 v11; 
  INT64 v12; 
  __int16 v13; 
  __int128 v14; 
  __int64 *v15; 
  int v16; 
  INT64 *v17; 
  INT64 **v18; 
  int v19; 
  v8 = a2;
  if( PfSnNumActiveTraces >= (unsigned int)dword_140C4FE88 )
  {
    return(unsigned int)-1073741618;
  }
  else if( FsRtlpVolumeStartupApplicationsComplete )
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x258ui64, 0x54506343ui64);
    v11 = (INT64)PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      *(_DWORD *)v11 = 1128485697;
      KeInitializeTimerEx((PKTIMER)(v11 + 136), NotificationTimer);
      v12 = v11 + 104;
      *(_QWORD *)(v11 + 112) = v11 + 104;
      *(_QWORD *)(v11 + 104) = v11 + 104;
      *(_QWORD *)(v11 + 128) = 0i64;
      *(_DWORD *)(v11 + 456) = -1073741779;
      *(_QWORD *)(v11 + 464) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
      *(_QWORD *)(v11 + 520) = 0i64;
      *(_QWORD *)(v11 + 528) = 0i64;
      *(_QWORD *)(v11 + 272) = 0i64;
      KeInitializeDpc((PRKDPC)(v11 + 208), (PKDEFERRED_ROUTINE)PfSnTraceTimerRoutine, (PVOID)v11);
      ExInitializePushLock((EX_RUNDOWN_REF *)(v11 + 360));
      ExAcquireRundownProtection((PEX_RUNDOWN_REF)(v11 + 360));
      ObfReferenceObjectWithTag(a3, 0x73576650u);
      *(_QWORD *)(v11 + 352) = a3;
      *(_QWORD *)(v11 + 368) = 0i64;
      *(_QWORD *)(v11 + 384) = PfSnEndTraceWorkerThreadRoutine;
      *(_QWORD *)(v11 + 392) = v11;
      *(_DWORD *)(v11 + 400) = 0;
      v13 = *(_WORD *)(v11 + 486);
      *(_OWORD *)(v11 + 24) = *a1;
      *(_OWORD *)(v11 + 40) = a1[1];
      *(_OWORD *)(v11 + 56) = a1[2];
      v14 = a1[3];
      *(_WORD *)(v11 + 486) = v13 & 0xFFFE | (a5 != 0);
      v15 = &qword_140C4FE68[2 * v8];
      *(_DWORD *)(v11 + 88) = v8;
      *(_OWORD *)(v11 + 72) = v14;
      v16 = *(_DWORD *)v15;
      *(_DWORD *)(v11 + 340) = *(_DWORD *)v15;
      *(_QWORD *)(v11 + 200) = v15[1];
      if( v16 )
      {
        if( v16 > 0x100000 )
          *(_DWORD *)(v11 + 340) = 0x100000;
        *(_QWORD *)(v11 + 96) = PfSnTraceBufferAllocate();
        if( *(_QWORD *)(v11 + 96) )
        {
          v17 = *(INT64 **)(v11 + 96);
          v18 = *(INT64 ***)(v11 + 112);
          if( *v18 != (INT64 *)v12 )
            __fastfail(3u);
          *v17 = v12;
          v17[1] = (INT64)v18;
          *v18 = v17;
          *(_QWORD *)(v11 + 112) = v17;
          *(_QWORD *)(v11 + 424) = -1i64;
          *(_QWORD *)(v11 + 416) = -8i64;
          *(_DWORD *)(v11 + 120) = 1;
          *(_QWORD *)(v11 + 408) = v11 + 416;
          if( a4 )
          {
            *(_QWORD *)(v11 + 432) = a4;
            *(_QWORD *)(v11 + 440) = PsGetThreadId((PETHREAD)a4);
          }
          v19 = PfSnActivateTrace(v11);
          if( v19 >= 0 )
          {
            *a6 = v11;
            v11 = 0i64;
            v19 = 0;
          }
        }
        else
        {
          v19 = -1073741670;
        }
      }
      else
      {
        v19 = -1073741811;
      }
      if( v11 )
      {
        PfSnCleanupTrace(v11);
        ExFreePoolWithTag((PVOID)v11, 0);
      }
    }
    else
    {
      return(unsigned int)-1073741670;
    }
  }
  else
  {
    return(unsigned int)-1073741661;
  }
  return(unsigned int)v19;
}

Referenced by: