KeSetSystemServiceCallback

NTSTATUS __stdcall KeSetSystemServiceCallback(_BYTE *a1, CHAR a2, INT64 a3, INT64 a4){
  NTSTATUS v4; 
  __int64 v9; 
  __int64 v10; 
  unsigned int v11; 
  __int64 v12; 
  _DWORD *i; 
  __int64 v14; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v16; 
  char v17; 
  char v18; 
  signed __int32 v20[14]; 

  v4 = 0;
  if( a3 && a3 != *(__int64 *)((char *)&KiDynamicTraceCallouts[3] + (-(__int64)(a2 != 0) & 0xFFFFFFFFFFFFFFF8ui64)) )
    return -1073741790;
  LODWORD(v9) = KiGetSystemServiceTraceTable();
  v10 = v9;
  if( !v9 )
    return -1073741670;
  v11 = 0;
  while( *a1 )
  {
    v11 = ((1025 * (v11 + (char)*a1)) >> 6) ^ (1025 * (v11 + (char)*a1));
    ++a1;
  }
  v12 = 0i64;
  for( i = (_DWORD *)(v10 + 52); v11 != *i; i += 16 )
  {
    v12 = (unsigned int)(v12 + 1);
    if( (unsigned int)v12 >= 0x1D7 )
      return -1073741275;
  }
  v14 = (v12 << 6) + v10 + 16;
  if( !v14 )
    return -1073741275;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&KiSystemServiceTraceCallbackLock, 0i64);
  v16 = -(__int64)(a2 != 0) & 0xFFFFFFFFFFFFFFF8ui64;
  v17 = -a2;
  v18 = *(_BYTE *)(v14 - (v17 != 0) + 41);
  if( a3 )
  {
    if( v18 )
    {
      v4 = -1073740008;
    }
    else
    {
      *(_QWORD *)(v16 + v14 + 56) = a4;
      _InterlockedOr(v20, 0);
      *(_BYTE *)(v14 - (v17 != 0) + 41) = 1;
      if( ++KiSystemServiceTraceCallbackCount == 1 )
        _InterlockedOr(&KiDynamicTraceMask, 1u);
    }
  }
  else if( v18 )
  {
    if( !--KiSystemServiceTraceCallbackCount )
      _InterlockedAnd(&KiDynamicTraceMask, 0xFFFFFFFE);
    *(_BYTE *)(v14 - (v17 != 0) + 41) = 0;
    _InterlockedOr(v20, 0);
    while( KiSystemServiceTraceCallbacksActive )
      _mm_pause();
    *(_QWORD *)(v16 + v14 + 56) = 0i64;
  }
  if( (_InterlockedExchangeAdd64(&KiSystemServiceTraceCallbackLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&KiSystemServiceTraceCallbackLock);
  KeAbPostRelease(&KiSystemServiceTraceCallbackLock);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v4;
}

Referenced by: