EtwpRegisterPrivateSession

INT64 __fastcall EtwpRegisterPrivateSession(INT64 a1, INT16 a2, _WORD *a3, _DWORD *a4){
  unsigned __int64 *v4; 
  _ETHREAD *CurrentThread; 
  __int64 *v8; 
  bool v9; 
  int v10; 
  __int64 *v11; 
  __int64 *PoolWithTag; 
  __int64 *v13; 
  unsigned int inserted; 
  __int64 *v15; 
  __int64 *i; 
  _WORD *v17; 
  _QWORD *v18; 
  __int64 v19; 
  UINT64 v20; 
  UINT64 v21; 
  PVOID Object; 
  PVOID Handle; 
  PVOID NewObject; 
  ULONG_PTR BugCheckParameter2; 
  __int128 v26; 
  __int128 v27; 
  __int128 v28; 
  v4 = (unsigned __int64 *)(a1 + 4080);
  Handle = 0i64;
  Object = 0i64;
  NewObject = 0i64;
  v26 = 0i64;
  v27 = 0i64;
  v28 = 0i64;
  if( *((_BYTE *)KeGetCurrentThread() + 562) != 1 )
    return 3221225659i64;
  if( a2 < 0 || (unsigned __int16)a2 > 8u )
    return 3221225485i64;
  LODWORD(v21) = (unsigned int)PsGetCurrentThreadProcessId();
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  BugCheckParameter2 = (ULONG_PTR)(v4 + 2);
  ExAcquirePushLockExclusiveEx((UINT64)(v4 + 2), 0i64);
  v8 = (__int64 *)*v4;
  v9 = 0;
  if( *v4 )
  {
    while( 1 )
    {
      v10 = PidNodeCompare(&v21, (INT64)v8);
      if( v10 <= 0 )
      {
        if( v10 >= 0 )
        {
          v13 = v8;
LABEL_16:
          v15 = v13 + 4;
          for( i = (__int64 *)v13[4]; i != v15; i = (__int64 *)*i )
          {
            if( *((_WORD *)i + 8) == a2 )
            {
              inserted = -1073741811;
              goto LABEL_25;
            }
            if( *((_WORD *)i + 8) > (unsigned __int16)a2 )
              break;
          }
          LODWORD(v26) = 48;
          *((_QWORD *)&v26 + 1) = 0i64;
          DWORD2(v27) = 64;
          *(_QWORD *)&v27 = 0i64;
          v28 = 0i64;
          inserted = ObCreateObjectEx(0, EtwpSessionDemuxObjectType, (__int64)&v26, 1, v19, 32, 0, 0, &Object, 0i64);
          if( !inserted )
          {
            v17 = Object;
            *((_WORD *)Object + 8) = a2;
            v17[10] = ++*(_WORD *)(a1 + 4104);
            *((_QWORD *)v17 + 3) = v13;
            v18 = (_QWORD *)i[1];
            i[1] = (__int64)v17;
            *v18 = v17;
            *((_QWORD *)v17 + 1) = v18;
            *(_QWORD *)v17 = i;
            ObReferenceObjectByPointer(v17, 0, EtwpSessionDemuxObjectType, 0);
            LODWORD(v20) = 0;
            inserted = ObInsertObjectEx(v17, 0i64, 0i64, 0i64, v20, &NewObject, &Handle);
            if( !inserted )
            {
              *a3 = v17[10];
              *a4 = (_DWORD)Handle;
              goto LABEL_27;
            }
          }
LABEL_25:
          if( (__int64 *)*v15 == v15 )
          {
            RtlRbRemoveNode(v4, (unsigned __int64)v13);
            ExFreePoolWithTag(v13, 0);
          }
          goto LABEL_27;
        }
        v11 = (__int64 *)*v8;
        if( !*v8 )
          break;
      }
      else
      {
        v11 = (__int64 *)v8[1];
        if( !v11 )
        {
          v9 = 1;
          break;
        }
      }
      v8 = v11;
    }
  }
  PoolWithTag = (__int64 *)ExAllocatePoolWithTag(PagedPool, 0x30ui64, 0x48777445ui64);
  v13 = PoolWithTag;
  if( PoolWithTag )
  {
    *((_DWORD *)PoolWithTag + 6) = v21;
    PoolWithTag[5] = (__int64)(PoolWithTag + 4);
    PoolWithTag[4] = (__int64)(PoolWithTag + 4);
    RtlRbInsertNodeEx(v4, (unsigned __int64)v8, v9, (unsigned __int64)PoolWithTag);
    goto LABEL_16;
  }
  inserted = -1073741801;
LABEL_27:
  ExReleasePushLockEx(BugCheckParameter2, 0i64);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( Object )
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  return inserted;
}

Referenced by: