EtwpUpdatePeriodicCaptureState

NTSTATUS __stdcall EtwpUpdatePeriodicCaptureState(UINT64 LoggerId, UINT64 a2, UINT16 a3, UINT8 *a4){
  __int64 v4; 
  int v5; 
  unsigned int v7; 
  _ESERVERSILO_GLOBALS *CurrentServerSiloGlobals; 
  _WMI_LOGGER_CONTEXT *v9; 
  _WMI_LOGGER_CONTEXT *v10; 
  int v11; 
  PERIODIC_CAPTURE_STATE_CONTEXT *PeriodicCaptureStateContext; 
  VOID **PoolWithTag; 
  _GUID *Providers; 
  VOID **v15; 
  VOID **Timer; 
  INT64 v17; 
  INT64 v18; 
  unsigned int v20; 
  _EXT_SET_PARAMETERS_V0 Parameters; 

  v4 = a3;
  v20 = a2;
  Parameters = 0i64;
  v5 = 0;
  v7 = LoggerId;
  CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)LoggerId);
  v9 = EtwpAcquireLoggerContextByLoggerId(CurrentServerSiloGlobals->EtwSiloState, v7, 0);
  v10 = v9;
  if( v9 )
  {
    if( (v9->Flags & 0x40) != 0 )
    {
      v5 = -1073741162;
LABEL_28:
      EtwpReleaseLoggerContext(v10, 0);
      return v5;
    }
    v11 = 0;
    if( (_DWORD)v4 )
    {
      while( 1 )
      {
        v5 = EtwpCheckNotificationAccess((_GUID *)&a4[16 * v11], &v10->InstanceGuid);
        if( v5 < 0 )
          break;
        if( ++v11 >= (int)v4 )
          goto LABEL_8;
      }
      v5 = -1073741790;
      goto LABEL_28;
    }
LABEL_8:
    ExAcquirePushLockExclusiveEx(&v10->LoggerLock, 0i64);
    PeriodicCaptureStateContext = v10->PeriodicCaptureStateContext;
    if( !PeriodicCaptureStateContext )
    {
      if( !(_WORD)v4 )
      {
LABEL_25:
        if( (_InterlockedExchangeAdd64(&v10->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock(&v10->LoggerLock);
        KeAbPostRelease(&v10->LoggerLock);
        goto LABEL_28;
      }
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x48ui64, 1433891909i64);
      v10->PeriodicCaptureStateContext = (PERIODIC_CAPTURE_STATE_CONTEXT *)PoolWithTag;
      if( !PoolWithTag )
      {
LABEL_11:
        v5 = -1073741801;
        goto LABEL_25;
      }
      memset(PoolWithTag, 0i64, 0x48u);
      PeriodicCaptureStateContext = v10->PeriodicCaptureStateContext;
    }
    Providers = PeriodicCaptureStateContext->Guids.Providers;
    if( Providers )
    {
      if( PeriodicCaptureStateContext->Timer )
      {
        ExCancelTimer((INT64)PeriodicCaptureStateContext->Timer);
        Providers = PeriodicCaptureStateContext->Guids.Providers;
        PeriodicCaptureStateContext->TimerState = EtwpPeriodicTimerUnset;
      }
      ExFreePoolWithTag(Providers, 0);
      PeriodicCaptureStateContext->Guids.Providers = 0i64;
      PeriodicCaptureStateContext->Guids.ProviderCount = 0;
    }
    if( !(_WORD)v4 )
      goto LABEL_25;
    v15 = ExAllocatePoolWithTag(1ui64, 16 * v4, 1433891909i64);
    PeriodicCaptureStateContext->Guids.Providers = (_GUID *)v15;
    if( !v15 )
      goto LABEL_11;
    PeriodicCaptureStateContext->Guids.ProviderCount = v4;
    memmove(v15, a4, 16 * v4);
    if( !PeriodicCaptureStateContext->Timer )
    {
      Timer = ExAllocateTimer((INT64)PeriodicCaptureStateTimerCallback, (INT64)v10, 8ui64);
      PeriodicCaptureStateContext->Timer = (struct _EX_TIMER *)Timer;
      if( !Timer )
      {
        ExFreePoolWithTag(PeriodicCaptureStateContext->Guids.Providers, 0);
        PeriodicCaptureStateContext->Guids.Providers = 0i64;
        PeriodicCaptureStateContext->Guids.ProviderCount = 0;
        goto LABEL_11;
      }
      PeriodicCaptureStateContext->WorkItem.Parameter = v10;
      PeriodicCaptureStateContext->WorkItem.WorkerRoutine = (void(__fastcall *)(void *))SendCaptureStateNotificationsWorker;
      PeriodicCaptureStateContext->WorkItem.List.Flink = 0i64;
    }
    Parameters.NoWakeTolerance = -1i64;
    v17 = (INT64)PeriodicCaptureStateContext->Timer;
    v18 = -10000000i64 * v20;
    PeriodicCaptureStateContext->RelativeTimerDueTime = v18;
    ExSetTimer(v17, v18, 0i64, (INT64)&Parameters);
    PeriodicCaptureStateContext->TimerState = EtwpPeriodicTimerSet;
    goto LABEL_25;
  }
  return -1073741811;
}

Referenced by: