EtwpCreateUmReplyObject

NTSTATUS __stdcall EtwpCreateUmReplyObject(_ETW_GUID_ENTRY *GuidEntry, PVOID *Handle, _ETW_REG_ENTRY **RegEntryPtr){
  VOID **PoolWithTag; 
  _KQUEUE *v7; 
  UINT64 v8; 
  int inserted; 
  PVOID v10; 
  __int64 v11; 
  char v12; 
  _QWORD *v13; 
  _ETW_REG_ENTRY *v14; 
  VOID *v16; 
  VOID *v17; 
  UINT64 ObjectBodySize; 
  PVOID *Handlea; 
  UINT64 v20; 
  PVOID NewObject; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID Object; 

  memset(&ObjectAttributes.Length + 1, 0, 20);
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  NewObject = 0i64;
  Object = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x48ui64, 1903653957i64);
  v7 = (_KQUEUE *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  memset(PoolWithTag, 0i64, 0x48u);
  KeInitializeQueue(v7, 0i64);
  LODWORD(v20) = 0;
  LOBYTE(v8) = 1;
  LODWORD(Handlea) = 0;
  LODWORD(ObjectBodySize) = 112;
  inserted = ObCreateObjectEx(
               0i64,
               EtwpRegistrationObjectType,
               &ObjectAttributes,
               v8,
               v16,
               ObjectBodySize,
               (UINT64)Handlea,
               v20,
               &Object,
               0i64);
  if( inserted < 0 )
  {
    ExFreePoolWithTag(v7, 0);
  }
  else
  {
    v10 = Object;
    memset(Object, 0i64, 0x70u);
    *((_WORD *)v10 + 49) = 4;
    *((_QWORD *)v10 + 6) = v7;
    EtwpReferenceGuidEntry(GuidEntry);
    *((_QWORD *)v10 + 4) = GuidEntry;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 170, 0i64);
    v11 = *(&ExBootDevicesRemovedEvent + 168);
    if( *(_UNKNOWN **)(*(&ExBootDevicesRemovedEvent + 168) + 8i64) != (_UNKNOWN *)((char *)&ExBootDevicesRemovedEvent
                                                                                  + 1344) )
      __fastfail(3u);
    *(_QWORD *)v10 = *(&ExBootDevicesRemovedEvent + 168);
    *((_QWORD *)v10 + 1) = (char *)&ExBootDevicesRemovedEvent + 1344;
    *(_QWORD *)(v11 + 8) = v10;
    *(&ExBootDevicesRemovedEvent + 168) = v10;
    v12 = _InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 170, 0xFFFFFFFFFFFFFFFFui64);
    if( (v12 & 2) != 0 && (v12 & 4) == 0 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 170);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1360);
    v13 = (char *)Object + 16;
    *((_QWORD *)Object + 3) = (char *)Object + 16;
    *v13 = v13;
    _InterlockedOr16((volatile signed __int16 *)v10 + 49, 0x80u);
    v14 = (_ETW_REG_ENTRY *)Object;
    LODWORD(v17) = 0;
    inserted = ObInsertObjectEx(Object, 0i64, 0x804ui64, 1ui64, (UINT64)v17, &NewObject, Handle);
    if( inserted >= 0 )
      *RegEntryPtr = v14;
  }
  return inserted;
}

Referenced by: