WmipQueueLegacyEtwWork

VOID **__fastcall WmipQueueLegacyEtwWork(_QWORD *a1, INT64 a2, __int64 a3){
  __int64 v6; 
  _QWORD *v7; 
  VOID **result; 
  _WORK_QUEUE_ITEM *v9; 
  VOID **PoolWithTag; 
  VOID ***v11; 
  _QWORD *v12; 
  VOID **v13; 
  VOID ***v14; 
  _QWORD *v15; 
  _QWORD *v16; 

  WmipReferenceEntry(a2);
  if( a3 )
  {
    if( (*(_DWORD *)(a2 + 16) & 0x10) == 0 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x38ui64, 1885957463i64);
      if( PoolWithTag )
      {
        PoolWithTag[2] = (VOID *)a2;
        PoolWithTag[4] = PoolWithTag + 3;
        PoolWithTag[3] = PoolWithTag + 3;
        PoolWithTag[6] = PoolWithTag + 5;
        PoolWithTag[5] = PoolWithTag + 5;
        v11 = *(VOID ****)(a3 + 8);
        if( *v11 != (VOID **)a3 )
          goto LABEL_17;
        *PoolWithTag = (VOID *)a3;
        PoolWithTag[1] = v11;
        *v11 = PoolWithTag;
        *(_QWORD *)(a3 + 8) = PoolWithTag;
        *(_DWORD *)(a2 + 16) |= 0x10u;
        *(_QWORD *)(a2 + 128) = PoolWithTag;
      }
    }
  }
  v6 = *(_QWORD *)(a2 + 128);
  if( !v6 )
  {
    v7 = *(_QWORD **)(a2 + 144);
    if( *v7 == a2 + 136 )
    {
      *a1 = a2 + 136;
      a1[1] = v7;
      *v7 = a1;
      *(_QWORD *)(a2 + 144) = a1;
      result = (VOID **)*(unsigned int *)(a2 + 16);
      if( ((unsigned __int8)result & 0x10) == 0 )
      {
        v9 = (_WORK_QUEUE_ITEM *)(*(_QWORD *)(a2 + 96) + 24i64);
        *(_DWORD *)(a2 + 16) = (unsigned int)result | 0x10;
        return(VOID **)ExQueueWorkItem(v9, DelayedWorkQueue);
      }
      return result;
    }
LABEL_17:
    __fastfail(3u);
  }
  result = (VOID **)(v6 + 24);
  v12 = *(_QWORD **)(v6 + 32);
  if( *v12 != v6 + 24 )
    goto LABEL_17;
  *a1 = result;
  a1[1] = v12;
  *v12 = a1;
  *(_QWORD *)(v6 + 32) = a1;
  if( a3 )
  {
    result = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1885957463i64);
    v13 = result;
    if( result )
    {
      KeInitializeEvent((INT64)(result + 4), 0, 0);
      v14 = *(VOID ****)(a3 + 24);
      if( *v14 == (VOID **)(a3 + 16) )
      {
        *v13 = (VOID *)(a3 + 16);
        v13[1] = v14;
        *v14 = v13;
        *(_QWORD *)(a3 + 24) = v13;
        result = (VOID **)(v6 + 40);
        v15 = *(_QWORD **)(v6 + 48);
        v16 = v13 + 2;
        if( *v15 == v6 + 40 )
        {
          *v16 = result;
          v16[1] = v15;
          *v15 = v16;
          *(_QWORD *)(v6 + 48) = v16;
          return result;
        }
      }
      goto LABEL_17;
    }
  }
  return result;
}

Referenced by:

WmipLegacyEtwCallback
WmipRegisterEtwProvider
WmipUnregisterEtwProvider