InsertEventEntryInLookUpTable

__int64 __fastcall InsertEventEntryInLookUpTable(__int64 a1, __int128 *a2, unsigned __int8 r8_0, __int64 a4, char a5){
  __int64 v5; 
  unsigned __int8 v6; 
  unsigned int v7; 
  int v8; 
  volatile signed __int64 *v9; 
  _ETHREAD *CurrentThread; 
  __int64 v11; 
  __int64 v12; 
  char v13; 
  NTSTATUS SessionId; 
  bool v15; 
  char v16; 
  volatile signed __int64 *i; 
  __int64 v18; 
  int v19; 
  NTSTATUS v20; 
  unsigned __int8 v21; 
  signed __int64 v22; 
  __int64 v23; 
  int v24; 
  volatile signed __int64 *v25; 
  unsigned int v27; 
  unsigned int v28; 
  unsigned __int8 AbOrphanedEntrySummary; 
  signed __int64 v30; 
  volatile signed __int64 v31; 
  volatile int *v32; 
  unsigned __int8 v33; 
  UINT64 a3; 
  __int64 v35; 
  __int64 v36; 
  __int64 CurrentIrql; 

  v5 = *(_QWORD *)(a1 + 48);
  v6 = a5;
  v35 = 0i64;
  v36 = v5;
  v7 = 0;
  v8 = ComputeEventEntryHash(a5, r8_0, a4);
  CurrentIrql = KeGetCurrentIrql();
  if( (unsigned __int8)CurrentIrql >= 2u )
  {
    if( *(_BYTE *)(v5 + 373) )
      KeBugCheckEx(0xD1u, (PVOID)(v5 + 280), (PVOID)KeGetCurrentIrql(), (PVOID)1, 0i64);
    ExAcquireSpinLockSharedAtDpcLevel((PEX_SPIN_LOCK)(v5 + 280));
  }
  else
  {
    if( (KeGetPcr()->Prcb._bf_0 & 0x10001) == 0 )
    {
      LODWORD(a3) = 0;
      v9 = (volatile signed __int64 *)(v5 + 272);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.SpecialApcDisable;
      ++CurrentThread->Tcb.AbAllocationRegionCount;
      v11 = 0i64;
      if( CurrentThread->Tcb.AbAllocationRegionCount != 1 )
        KeBugCheckEx(0x192u, CurrentThread, (PVOID)(v5 + 272), (PVOID)KeGetCurrentIrql(), 0i64);
      LOBYTE(v12) = CurrentThread->Tcb.AbEntrySummary;
      if( !(_BYTE)v12 )
      {
        if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
          goto LABEL_48;
        AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
        CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
        LOBYTE(v12) = AbOrphanedEntrySummary | CurrentThread->Tcb.AbEntrySummary;
      }
      v13 = v12;
      _BitScanForward((unsigned int *)&v12, (unsigned __int8)v12);
      CurrentThread->Tcb.AbEntrySummary = v13 & ~(1 << v12);
      v11 = (__int64)&CurrentThread->Tcb.LockEntries[v12];
      if( v11 )
      {
        if( (unsigned __int64)v9 >= 0xFFFF800000000000ui64
          && *((_BYTE *)&stru_140C4DB30 + (((unsigned __int64)v9 >> 39) & 0x1FF) + 6872) == 1 )
        {
          SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
        }
        else
        {
          SessionId = -1;
        }
        *(_DWORD *)(v11 + 40) = SessionId;
        *(_QWORD *)(v11 + 32) = (unsigned __int64)v9 & 0x7FFFFFFFFFFFFFFCi64;
        goto LABEL_10;
      }
LABEL_48:
      _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
LABEL_10:
      --CurrentThread->Tcb.AbAllocationRegionCount;
      KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)(v5 + 272), &a3);
      v15 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
      if( v15
        && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
      {
        KiCheckForKernelApcDelivery();
      }
      if( _InterlockedCompareExchange64(v9, 17i64, 0i64) )
        ExfAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v5 + 272), (VOID *)v11, (VOID *)(v5 + 272));
      if( v11 )
        *(_BYTE *)(v11 + 26) |= 1u;
      v6 = a5;
      v16 = 0;
      goto LABEL_18;
    }
    if( *(_BYTE *)(v5 + 373) )
      KeBugCheckEx(0xD1u, (PVOID)(v5 + 280), (PVOID)KeGetCurrentIrql(), (PVOID)1, 0i64);
    ExAcquireSpinLockShared((INT64 *)(v5 + 280));
  }
  v16 = 1;
LABEL_18:
  for( i = (volatile signed __int64 *)(v5 + 8i64 * (v8 & 0x1F));
        ;
        i = (volatile signed __int64 *)((((__int64)v20 >> 63) & 0xFFFFFFFFFFFFFFF8ui64) + v18 + 32) )
  {
    if( !*i )
    {
      if( *(_DWORD *)(v5 + 256) >= 0x400u )
      {
        ++*(_DWORD *)(v5 + 316);
        v7 = -1073741789;
        goto LABEL_29;
      }
      if( !v35 )
      {
        v27 = CreateNewEventEntry(*(_BYTE *)(v5 + 373), a2, r8_0, a4, v6, v8, &v35);
        v7 = v27;
        if( !v35 )
        {
          if( v27 == -1073741801 )
            ++*(_DWORD *)(v5 + 320);
          else
            ++*(_DWORD *)(v5 + 324);
          goto LABEL_29;
        }
      }
      if( !_InterlockedCompareExchange64(i, v35, 0i64) )
      {
        v35 = 0i64;
        if( !_InterlockedExchangeAdd((volatile signed __int32 *)(v5 + 256), 1u) )
          EnableFlushTimer(*(_EX_TIMER **)(v5 + 360), *(unsigned int *)(v5 + 368));
        v28 = *(_DWORD *)(v5 + 256);
        if( *(_DWORD *)(v5 + 304) < v28 )
          *(_DWORD *)(v5 + 304) = v28;
        goto LABEL_29;
      }
    }
    v18 = *i;
    v19 = *(_DWORD *)(v18 + 40);
    v20 = v8 == v19 ? CompareEventEntry(r8_0, a4, v18) : v8 - v19;
    if( !v20 )
      break;
  }
  if( v18 )
  {
    v21 = 2;
    if( v6 )
    {
      do
      {
        v22 = **(_QWORD **)(a4 + 16i64 * v21);
        v23 = *(_QWORD *)(v18 + 16);
        v24 = *(unsigned __int8 *)(v23 + 16i64 * v21 + 13);
        v25 = *(volatile signed __int64 **)(v23 + 16i64 * v21);
        if( v24 == 113 )
        {
          _InterlockedExchangeAdd64(v25, v22);
        }
        else if( (unsigned int)(v24 - 114) <= 1 )
        {
          do
          {
            v30 = *v25;
            if( v24 == 114 )
            {
              if( v22 >= v30 )
                break;
            }
            else if( v22 <= v30 )
            {
              break;
            }
            v31 = *v25;
          }
          while( v31 != _InterlockedCompareExchange64(v25, v22, v30) );
        }
        ++v21;
      }
      while( v21 < (unsigned int)v6 + 2 );
      v5 = v36;
    }
  }
LABEL_29:
  if( v16 )
  {
    v32 = (volatile int *)(v5 + 280);
    v33 = CurrentIrql;
    ExReleaseSpinLockSharedFromDpcLevel(v32);
    if( v33 < 2u )
      __writecr8(v33);
  }
  else
  {
    if( _InterlockedCompareExchange64((volatile signed __int64 *)(v5 + 272), 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((_EX_PUSH_LOCK *)(v5 + 272));
    KeAbPostRelease((VOID *)(v5 + 272));
  }
  if( v35 )
    ExFreePoolWithTag(*(PVOID *)(v35 + 16), 0);
  return v7;
}

Referenced by: