PfSnActivateTrace

NTSTATUS __stdcall PfSnActivateTrace(PFSN_TRACE_HEADER *Trace){
  unsigned __int64 v2; 
  int v3; 
  PFSN_TRACE_HEADER **v4; 
  PFSN_TRACE_HEADER *v5; 

  if( !ExAcquireRundownProtection(&RunRef) )
    return -1073741127;
  *((_WORD *)Trace + 243) |= 2u;
  v2 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&qword_140C50190);
  v3 = PfSnAddProcessTrace(*((_EPROCESS **)Trace + 44), Trace);
  if( v3 >= 0 )
  {
    v4 = (PFSN_TRACE_HEADER **)qword_140C50188;
    v5 = Trace + 2;
    if( (_QWORD *)*qword_140C50188 != &qword_140C50180 )
      __fastfail(3u);
    ++PfSnNumActiveTraces;
    *(_QWORD *)v5 = &qword_140C50180;
    v3 = 0;
    *((_QWORD *)Trace + 2) = v4;
    *v4 = v5;
    qword_140C50188 = Trace + 2;
  }
  KxReleaseSpinLock(&qword_140C50190);
  __writecr8(v2);
  return v3;
}

Referenced by: