VslGetEtwDebugId

NTSTATUS __stdcall VslGetEtwDebugId(INT64 a1, INT64 a2, INT64 *a3, UINT64 *a4){
  void *v8; 
  int v9; 
  VOID **PoolWithTag; 
  INT64 v12[10]; 
  INT64 v13[14]; 

  memset(v13, 0i64, 0x68u);
  memset(v12, 0i64, 0x48u);
  v8 = (void *)*a3;
  v9 = VslpLockPagesForTransfer((INT64)v12, *a3, *(unsigned int *)a4, 2i64, 0);
  if( v9 < 0 )
  {
LABEL_12:
    if( v8 != (void *)*a3 && v8 )
      ExFreePoolWithTag(v8, 0);
  }
  else
  {
    while( 1 )
    {
      v13[1] = *(_QWORD *)(a1 + 992);
      v13[4] = v12[7];
      v13[3] = v12[0];
      v13[2] = a2;
      v9 = VslpEnterIumSecureMode(2u, 17, 0i64, (INT64)v13);
      VslpUnlockPagesForTransfer((INT64 **)v12);
      *(_DWORD *)a4 = v13[5];
      if( v9 >= 0 )
        break;
      if( v9 != -1073741789 )
        goto LABEL_10;
      if( v8 != (void *)*a3 )
        ExFreePoolWithTag(v8, 0);
      PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)a4, 1416850774i64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
      {
        v9 = -1073741670;
LABEL_10:
        if( v9 < 0 )
          goto LABEL_12;
        break;
      }
      v9 = VslpLockPagesForTransfer((INT64)v12, (INT64)PoolWithTag, *(unsigned int *)a4, 2i64, 0);
      if( v9 < 0 )
        goto LABEL_10;
    }
    *a3 = (INT64)v8;
  }
  return v9;
}

Referenced by:

EtwpLocateDbgIdForRegEntry