ExRegisterHost

NTSTATUS __stdcall ExRegisterHost(_EX_HOST **Host, UINT64 RegistrationVersion, PVOID RegistrationInfo){
  VOID **PoolWithTag; 
  NTSTATUS v6; 
  __int64 v7; 
  _ETHREAD *CurrentThread; 
  _BYTE *v9; 
  _BYTE *v10; 
  _EX_HOST *v11; 
  __int64 *v12; 
  char v13; 

  PoolWithTag = ExAllocatePoolWithTag(*((unsigned int *)RegistrationInfo + 2), 0x60ui64, 1212512325i64);
  v6 = 0;
  v7 = (__int64)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  *((_BYTE *)PoolWithTag + 88) &= ~1u;
  *((_DWORD *)PoolWithTag + 4) = 1;
  PoolWithTag[10] = 0i64;
  *(_OWORD *)(PoolWithTag + 3) = *(_OWORD *)RegistrationInfo;
  *(_OWORD *)(PoolWithTag + 5) = *((_OWORD *)RegistrationInfo + 1);
  PoolWithTag[7] = (VOID *)*((_QWORD *)RegistrationInfo + 4);
  PoolWithTag[9] = 0i64;
  PoolWithTag[8] = 0i64;
  ExWaitForRundownProtectionRelease((_EX_RUNDOWN_REF *)PoolWithTag + 8);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v9 = KeAbPreAcquire(&ExpHostListLock, 0i64, 0i64);
  v10 = v9;
  if( _interlockedbittestandset64((volatile signed __int32 *)&ExpHostListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx(&ExpHostListLock, v9, &ExpHostListLock);
  if( v10 )
    v10[26] |= 1u;
  v11 = ExpFindHost(*(_WORD *)RegistrationInfo, *((_WORD *)RegistrationInfo + 1));
  if( v11 )
  {
    v6 = -1073741771;
    ExpDereferenceHost((_EX_HOST *)v7);
    ExpDereferenceHost(v11);
  }
  else
  {
    v12 = (__int64 *)qword_140D2DBD8;
    if( *(__int64 **)qword_140D2DBD8 != &ExpHostList )
      __fastfail(3u);
    *(_QWORD *)v7 = &ExpHostList;
    *(_QWORD *)(v7 + 8) = v12;
    *v12 = v7;
    qword_140D2DBD8 = v7;
    *Host = (_EX_HOST *)v7;
  }
  v13 = _InterlockedExchangeAdd64(&ExpHostListLock._bf_0, 0xFFFFFFFFFFFFFFFFui64);
  if( (v13 & 2) != 0 && (v13 & 4) == 0 )
    ExfTryToWakePushLock(&ExpHostListLock);
  KeAbPostRelease(&ExpHostListLock);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v6;
}

Referenced by: