EtwRegisterEventCallback

NTSTATUS __stdcall EtwRegisterEventCallback(UINT64 a1, INT64 a2, INT64 a3){
  unsigned int v5; 
  NTSTATUS v6; 
  _ETW_SILODRIVERSTATE *EtwSiloState; 
  _ETHREAD *CurrentThread; 
  _WMI_LOGGER_CONTEXT *v9; 
  VOID **PoolWithTag; 

  v5 = a1;
  v6 = 0;
  EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)a1)->EtwSiloState;
  if( !a2 || a2 != qword_140CFBB98 )
    return -1073741790;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v9 = EtwpAcquireLoggerContextByLoggerId(EtwSiloState, v5, 0);
  if( v9 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x10ui64, 1131902021i64);
    if( PoolWithTag )
    {
      PoolWithTag[1] = (VOID *)a3;
      if( _InterlockedCompareExchange64(
             (volatile signed __int64 *)&v9->CallbackContext,
             (signed __int64)PoolWithTag,
             0i64) )
      {
        v6 = -1073741811;
        ExFreePoolWithTag(PoolWithTag, 0);
      }
    }
    else
    {
      v6 = -1073741670;
    }
    EtwpReleaseLoggerContext(v9, 0);
  }
  else
  {
    v6 = -1073741162;
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v6;
}

Referenced by: