WmipQueueLegacyEtwWork
VOID **__fastcall WmipQueueLegacyEtwWork(_QWORD *a1, INT64 a2, __int64 a3){
__int64 v6;
_QWORD *v7;
VOID **result;
_WORK_QUEUE_ITEM *v9;
VOID **PoolWithTag;
VOID ***v11;
_QWORD *v12;
VOID **v13;
VOID ***v14;
_QWORD *v15;
_QWORD *v16;
WmipReferenceEntry(a2);
if( a3 )
{
if( (*(_DWORD *)(a2 + 16) & 0x10) == 0 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x38ui64, 1885957463i64);
if( PoolWithTag )
{
PoolWithTag[2] = (VOID *)a2;
PoolWithTag[4] = PoolWithTag + 3;
PoolWithTag[3] = PoolWithTag + 3;
PoolWithTag[6] = PoolWithTag + 5;
PoolWithTag[5] = PoolWithTag + 5;
v11 = *(VOID ****)(a3 + 8);
if( *v11 != (VOID **)a3 )
goto LABEL_17;
*PoolWithTag = (VOID *)a3;
PoolWithTag[1] = v11;
*v11 = PoolWithTag;
*(_QWORD *)(a3 + 8) = PoolWithTag;
*(_DWORD *)(a2 + 16) |= 0x10u;
*(_QWORD *)(a2 + 128) = PoolWithTag;
}
}
}
v6 = *(_QWORD *)(a2 + 128);
if( !v6 )
{
v7 = *(_QWORD **)(a2 + 144);
if( *v7 == a2 + 136 )
{
*a1 = a2 + 136;
a1[1] = v7;
*v7 = a1;
*(_QWORD *)(a2 + 144) = a1;
result = (VOID **)*(unsigned int *)(a2 + 16);
if( ((unsigned __int8)result & 0x10) == 0 )
{
v9 = (_WORK_QUEUE_ITEM *)(*(_QWORD *)(a2 + 96) + 24i64);
*(_DWORD *)(a2 + 16) = (unsigned int)result | 0x10;
return(VOID **)ExQueueWorkItem(v9, DelayedWorkQueue);
}
return result;
}
LABEL_17:
__fastfail(3u);
}
result = (VOID **)(v6 + 24);
v12 = *(_QWORD **)(v6 + 32);
if( *v12 != v6 + 24 )
goto LABEL_17;
*a1 = result;
a1[1] = v12;
*v12 = a1;
*(_QWORD *)(v6 + 32) = a1;
if( a3 )
{
result = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1885957463i64);
v13 = result;
if( result )
{
KeInitializeEvent((INT64)(result + 4), 0, 0);
v14 = *(VOID ****)(a3 + 24);
if( *v14 == (VOID **)(a3 + 16) )
{
*v13 = (VOID *)(a3 + 16);
v13[1] = v14;
*v14 = v13;
*(_QWORD *)(a3 + 24) = v13;
result = (VOID **)(v6 + 40);
v15 = *(_QWORD **)(v6 + 48);
v16 = v13 + 2;
if( *v15 == v6 + 40 )
{
*v16 = result;
v16[1] = v15;
*v15 = v16;
*(_QWORD *)(v6 + 48) = v16;
return result;
}
}
goto LABEL_17;
}
}
return result;
}Referenced by:
WmipLegacyEtwCallback
WmipRegisterEtwProvider
WmipUnregisterEtwProvider