PsRegisterSiloMonitor

NTSTATUS __stdcall PsRegisterSiloMonitor(_SILO_MONITOR_REGISTRATION *Registration, _SILO_MONITOR **ReturnedMonitor){
  _WORD *v4; 
  _EJOB *CurrentSilo; 
  __int64 v6; 
  VOID **PoolWithTag; 
  VOID **v8; 
  int v9; 

  if( !*(_BYTE *)Registration )
    return -1073741811;
  v4 = (_WORD *)*((_QWORD *)Registration + 1);
  if( !v4 || !*v4 || !*((_QWORD *)Registration + 2) && !*((_QWORD *)Registration + 3) )
    return -1073741811;
  CurrentSilo = PsGetCurrentSilo();
  if( !PsIsHostSilo(CurrentSilo) )
    return -1073741727;
  v6 = **((unsigned __int16 **)Registration + 1);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v6 + 56, 1298950483i64);
  v8 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, v6 + 56);
  *((_BYTE *)v8 + 16) = *((_BYTE *)Registration + 1);
  *((_BYTE *)v8 + 17) = *((_BYTE *)Registration + 2);
  v8[3] = (VOID *)*((_QWORD *)Registration + 2);
  v8[4] = (VOID *)*((_QWORD *)Registration + 3);
  v8[6] = v8 + 7;
  *((_WORD *)v8 + 21) = v6;
  RtlCopyUnicodeString((PUNICODE_STRING)(v8 + 5), *((PCUNICODE_STRING *)Registration + 1));
  v9 = PspStorageAllocSlot((UINT64 *)((char *)v8 + 20));
  if( v9 < 0 )
  {
    ExFreePoolWithTag(v8, 0x4D6C6953u);
    return v9;
  }
  else
  {
    *ReturnedMonitor = (_SILO_MONITOR *)v8;
    return 0;
  }
}

Referenced by: