EtwpRegisterPartitionPages

CHAR __stdcall EtwpRegisterPartitionPages(INT64 a1, INT64 a2, INT64 a3){
  char v6; 
  VOID **PoolWithTag; 
  VOID **v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  char *v11; 
  char v12; 
  unsigned __int64 v13; 
  char v14; 
  unsigned int v15; 
  __int64 v16; 
  __int64 v17; 
  _QWORD *v18; 
  __int64 v19; 
  VOID *v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v24; 
  __int64 v25; 

  v6 = 0;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x20ui64, 1333228613i64);
  v8 = PoolWithTag;
  if( !PoolWithTag )
    return(char)PoolWithTag;
  PoolWithTag[1] = (VOID *)a3;
  PoolWithTag[2] = (VOID *)a2;
  PoolWithTag[3] = (VOID *)a1;
  v9 = (unsigned __int8)ExAcquireSpinLockExclusive((INT64 *)&ExBootDevicesRemovedEvent + 146);
  if( *(&ExBootDevicesRemovedEvent + 288) < (unsigned int)(2 * (*(&ExBootDevicesRemovedEvent + 289) >> 5)) )
    goto LABEL_24;
  v10 = (unsigned int)(2 * (*(&ExBootDevicesRemovedEvent + 289) >> 5));
  if( (unsigned int)v10 < 4 )
    v10 = 4i64;
  LODWORD(v11) = EtwpMdlHashTableAllocator(8 * v10);
  if( v11 )
  {
    if( (((_DWORD)v10 - 1) & (unsigned int)v10) != 0 )
    {
      v12 = -1;
      do
      {
        ++v12;
        LODWORD(v10) = (unsigned int)v10 >> 1;
      }
      while( (_DWORD)v10 );
      v10 = (unsigned int)(1 << v12);
    }
    if( (unsigned int)v10 > 0x4000000 )
      v10 = 0x4000000i64;
    v13 = (unsigned int)v10;
    if( v11 > &v11[8 * v10] )
      v13 = 0i64;
    if( v13 )
      memset64(v11, (unsigned __int64)&ExBootDevicesRemovedEvent + 1153, v13);
    v14 = *(&ExBootDevicesRemovedEvent + 1156);
    v15 = 0;
    v16 = -1i64 << (*(&ExBootDevicesRemovedEvent + 1156) & 0x1F);
    if( (*(&ExBootDevicesRemovedEvent + 289) & 0xFFFFFFE0) != 0 )
    {
      do
      {
        v17 = *(&ExBootDevicesRemovedEvent + 145);
        while( 1 )
        {
          v18 = *(_QWORD **)(v17 + 8i64 * v15);
          if( ((unsigned __int8)v18 & 1) != 0 )
            break;
          *(_QWORD *)(v17 + 8i64 * v15) = *v18;
          v25 = v16 & v18[1];
          v19 = (37
               * (BYTE6(v25)
                + 37
                * (BYTE5(v25)
                 + 37
                 * (BYTE4(v25)
                  + 37 * (BYTE3(v25) + 37 * (BYTE2(v25) + 37 * (BYTE1(v25) + 37 * ((unsigned __int8)v25 + 11623883)))))))
               + HIBYTE(v25)) & (unsigned int)(v10 - 1);
          *v18 = *(_QWORD *)&v11[8 * v19];
          *(_QWORD *)&v11[8 * v19] = v18;
        }
        v14 = *(&ExBootDevicesRemovedEvent + 1156);
        ++v15;
      }
      while( v15 < *(&ExBootDevicesRemovedEvent + 289) >> 5 );
    }
    v20 = (VOID *)*(&ExBootDevicesRemovedEvent + 145);
    *(&ExBootDevicesRemovedEvent + 145) = v11;
    *(&ExBootDevicesRemovedEvent + 289) = (32 * v10) | v14 & 0x1F;
    if( v20 )
      EtwpMdlHashTableDeallocator(v20);
    goto LABEL_24;
  }
  if( (*(&ExBootDevicesRemovedEvent + 289) & 0xFFFFFFE0) != 0 )
  {
LABEL_24:
    v6 = 1;
    v24 = (unsigned __int64)v8[1] & (-1i64 << (*(&ExBootDevicesRemovedEvent + 1156) & 0x1F));
    v21 = *(&ExBootDevicesRemovedEvent + 145);
    v22 = (37
         * (BYTE6(v24)
          + 37
          * (BYTE5(v24)
           + 37
           * (BYTE4(v24)
            + 37 * (BYTE3(v24) + 37 * (BYTE2(v24) + 37 * (BYTE1(v24) + 37 * ((unsigned __int8)v24 + 11623883)))))))
         + HIBYTE(v24)) & (unsigned int)((*(&ExBootDevicesRemovedEvent + 289) >> 5) - 1);
    *v8 = *(VOID **)(*(&ExBootDevicesRemovedEvent + 145) + 8 * v22);
    *(_QWORD *)(v21 + 8 * v22) = v8;
    ++*(&ExBootDevicesRemovedEvent + 288);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ExBootDevicesRemovedEvent + 146);
  __writecr8(v9);
  if( !v6 )
    ExFreePoolWithTag(v8, 0x4F777445u);
  LOBYTE(PoolWithTag) = v6;
  return(char)PoolWithTag;
}

Referenced by: