PsSetLoadImageNotifyRoutineEx

NTSTATUS __fastcall PsSetLoadImageNotifyRoutineEx(VOID *a1, UINT64 a2){
  VOID *v2; 
  VOID *v3; 
  _EX_RUNDOWN_REF *v5; 
  __int64 v6; 
  NTSTATUS v7; 
  PEVENT_DATA_DESCRIPTOR UserData; 
  VOID *v10; 
  NTSTATUS v11; 
  VOID *v12; 
  _EVENT_DATA_DESCRIPTOR v13; 
  int *v14; 
  int v15; 
  int v16; 

  if( (a2 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
    return -1073741584;
  v5 = (_EX_RUNDOWN_REF *)ExAllocateCallBack((INT64)a1, (INT64 *)a2, v2, v3, UserData, v10);
  if( v5 )
  {
    v6 = 0i64;
    while( !ExCompareExchangeCallBack(&CallBack + 2 * v6, v5, 0i64) )
    {
      v6 = (unsigned int)(v6 + 1);
      if( (unsigned int)v6 >= 0x40 )
      {
        ExFreePoolWithTag(v5, 0);
        goto LABEL_14;
      }
    }
    _InterlockedIncrement(&PspLoadImageNotifyRoutineCount);
    if( (PspNotifyEnableMask & 1) == 0 )
      _interlockedbittestandset(&PspNotifyEnableMask, 0);
    v7 = 0;
  }
  else
  {
LABEL_14:
    v7 = -1073741670;
  }
  v11 = v7;
  v12 = a1;
  if( *(&ExBootDevicesRemovedEvent + 379) )
  {
    v13.Reserved = 0;
    v16 = 0;
    v13.Ptr = (unsigned __int64)&v12;
    v13.Size = 8;
    v14 = &v11;
    v15 = 4;
    EtwWrite(*(&ExBootDevicesRemovedEvent + 379), &KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE, 0, 2u, &v13);
  }
  return v7;
}

Referenced by: