EtwpSetPartitionContext

NTSTATUS __stdcall EtwpSetPartitionContext(INT64 *a1, UINT64 a2){
  INT64 v3; 
  int v4; 
  INT64 v7; 

  v7 = 0i64;
  v3 = *a1;
  v4 = 0;
  if( v3 )
  {
    PsDereferencePartition(v3);
    *a1 = 0i64;
  }
  if( ((a2 + 2) & 0xFFFFFFFFFFFFFFFDui64) != 0 )
  {
    v4 = PsReferencePartitionByHandle((VOID *)a2, 2ui64, KeGetCurrentThread()->PreviousMode, 0x6F777445u, &v7);
    if( v4 >= 0 )
      *a1 = v7;
  }
  return v4;
}

Referenced by:

EtwpStartLogger