VfTargetEtwRegister

VOID __stdcall VfTargetEtwRegister(UINT64 RegHandle, PVOID CallerAddress){
  int v4; 
  _QWORD *PoolWithTag; 
  CHAR *v6; 
  __int64 v7; 
  __int64 v8; 
  _QWORD *v9; 
  __int128 v10; 
  v10 = 0i64;
  if( !VfSafeMode )
  {
    v4 = 0;
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x20ui64, 0x54456656ui64);
    VfAvlInitializeLockContext((INT64)&v10, 0i64);
    v6 = VfAvlLookupTreeNode(&ViTargetDriversAvl, (INT64)&v10, (UINT64)CallerAddress, 1i64);
    if( v6 )
    {
      v7 = *((_QWORD *)v6 + 7);
      if( v7 )
      {
        if( PoolWithTag )
        {
          v8 = v7 + 16;
          PoolWithTag[2] = RegHandle;
          PoolWithTag[3] = CallerAddress;
          v9 = *(_QWORD **)(v8 + 8);
          if( *v9 != v8 )
            __fastfail(3u);
          *PoolWithTag = v8;
          v4 = 1;
          PoolWithTag[1] = v9;
          *v9 = PoolWithTag;
          *(_QWORD *)(v8 + 8) = PoolWithTag;
        }
        else
        {
          *(_DWORD *)(v7 + 32) |= 1u;
        }
      }
    }
    VfAvlCleanupLockContext((INT64)&v10);
    if( !v4 )
    {
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0x54456656u);
    }
  }
}

Referenced by: