EtwpQueueNotification

NTSTATUS __stdcall EtwpQueueNotification(
        _EPROCESS *Process,
        _ETWP_NOTIFICATION_HEADER *DataBlock,
        _ETW_REG_ENTRY *RegEntry){
  NTSTATUS v3; 
  __int64 v5; 
  char v8; 
  VOID **v9; 
  VOID **PoolWithTag; 
  _ETW_QUEUE_ENTRY *v11; 
  _ETHREAD *CurrentThread; 
  _LIST_ENTRY *v13; 
  VOID **v14; 
  _ETW_QUEUE_ENTRY **v15; 
  _KEVENT *v16; 
  _ETW_REG_ENTRY *ReplyHandle; 
  unsigned int v19; 
  bool v20; 

  v3 = 0;
  v5 = RegEntry->Flags & 0x100;
  v8 = 1;
  v20 = (RegEntry->Flags & 0x100) != 0;
  v9 = EtwpAddDataSource((__int64)Process);
  if( !v9 )
    return -1073741801;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1920431173i64);
  v11 = (_ETW_QUEUE_ENTRY *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  *(_OWORD *)PoolWithTag = 0i64;
  *((_OWORD *)PoolWithTag + 1) = 0i64;
  *((_OWORD *)PoolWithTag + 2) = 0i64;
  PoolWithTag[6] = 0i64;
  PoolWithTag[2] = DataBlock;
  PoolWithTag[3] = RegEntry;
  *((_WORD *)PoolWithTag + 24) = RegEntry->Index;
  *((_DWORD *)PoolWithTag + 13) = 1;
  if( !DataBlock->ReplyRequested )
    goto LABEL_4;
  ReplyHandle = (_ETW_REG_ENTRY *)DataBlock->ReplyHandle;
  *((_DWORD *)PoolWithTag + 13) |= 2u;
  ObfReferenceObject(ReplyHandle);
  v11->ReplyObject = ReplyHandle;
  v11->WakeReference = PsChargeProcessWakeCounter(Process, 1ui64, PsWakeReasonInstrumentation, (UINT64)RegEntry);
  v19 = 0;
  v3 = -1073741823;
  while( _InterlockedCompareExchange64(
            (volatile signed __int64 *)&RegEntry->ReplyQueue + v19,
            (signed __int64)v11,
            0i64) )
  {
    if( ++v19 >= 4 )
      goto LABEL_18;
  }
  v11->ReplyIndex = v19;
  v3 = 0;
LABEL_18:
  if( v3 < 0 )
  {
    EtwpReleaseQueueEntry(v11, 3ui64);
  }
  else
  {
LABEL_4:
    _InterlockedIncrement(&DataBlock->RefCount);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v9 + 2, 0i64);
    v13 = (_LIST_ENTRY *)(v9 + 3);
    v14 = (VOID **)v9[3];
    if( v14 != v9 + 3 )
    {
      while( v20 != (*((_BYTE *)v14[3] + 99) & 1) )
      {
        v14 = (VOID **)*v14;
        if( v14 == (VOID **)v13 )
          goto LABEL_5;
      }
      v8 = 0;
    }
LABEL_5:
    v15 = (_ETW_QUEUE_ENTRY **)v9[4];
    if( *v15 != (_ETW_QUEUE_ENTRY *)v13 )
      __fastfail(3u);
    v11->ListEntry.Flink = v13;
    v11->ListEntry.Blink = (_LIST_ENTRY *)v15;
    *v15 = v11;
    v9[4] = v11;
    if( v8 )
    {
      if( (_WORD)v5 )
        v16 = (_KEVENT *)v9[1];
      else
        v16 = (_KEVENT *)*v9;
      if( v16 )
        KeSetEvent(v16, 1, 0);
    }
    ExReleasePushLockEx((_DWORD)v9 + 16, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return v3;
}

Referenced by: