WmipBuildTraceDeviceList

NTSTATUS __stdcall WmipBuildTraceDeviceList(
        UINT64 TraceClass,
        _WMIP_TRACE_DEVICE **DeviceListOut,
        UINT64 *DeviceCountOut){
  int v5; 
  _WMIP_TRACE_DEVICE *v6; 
  unsigned __int8 v7; 
  unsigned int v8; 
  unsigned __int64 v9; 
  VOID **PoolWithTag; 
  _QWORD *v11; 
  VOID **v12; 
  unsigned int v13; 
  int v14; 
  NTSTATUS v15; 

  v5 = TraceClass;
  v6 = 0i64;
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
  v7 = KeAcquireSpinLockRaiseToDpc((UINT64 *)&ExBootDevicesRemovedEvent + 436);
  v8 = dword_140C50314[0];
  v9 = v7;
  if( !dword_140C50314[0] )
  {
    v15 = -1073741632;
LABEL_15:
    KxReleaseSpinLock((UINT64 *)&ExBootDevicesRemovedEvent + 436);
    __writecr8(v9);
    KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
    goto LABEL_17;
  }
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 16i64 * dword_140C50314[0], 1885957463i64);
  v6 = (_WMIP_TRACE_DEVICE *)PoolWithTag;
  if( !PoolWithTag )
  {
    v15 = -1073741670;
    goto LABEL_15;
  }
  v11 = (_QWORD *)*(&stru_140C00F40 + 901);
  v12 = PoolWithTag;
  v13 = 0;
  while( v11 != (_QWORD *)((char *)&stru_140C00F40 + 7208) )
  {
    v14 = (*((int *)v11 + 12) >> 4) & 0xF00000;
    if( (v14 & v5) != 0 && (v11[6] & 0x40000000) != 0 && v11[2] && v13 < v8 )
    {
      _InterlockedIncrement((volatile signed __int32 *)v11 + 12);
      *v12 = v11;
      *((_DWORD *)v12 + 2) = v14;
      v12 += 2;
      ++v13;
    }
    v11 = (_QWORD *)*v11;
  }
  KxReleaseSpinLock((UINT64 *)&ExBootDevicesRemovedEvent + 436);
  __writecr8(v9);
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
  if( v13 )
  {
    *(_DWORD *)DeviceCountOut = v13;
    v15 = 0;
    *DeviceListOut = v6;
    return v15;
  }
  v15 = -1073741632;
LABEL_17:
  if( v6 )
    WmipFreeTraceDeviceList(v6, 0i64);
  return v15;
}

Referenced by: