EtwpInitializeCompression

NTSTATUS __fastcall EtwpInitializeCompression(__int64 a1){
  NTSTATUS result; 
  NTSTATUS v3; 
  VOID *v4; 
  unsigned int v5; 
  _DWORD *PoolWithTag; 
  SIZE_T NumberOfBytes; 
  ULONG v8; 
  *(_DWORD *)(a1 + 1156) = 5;
  LODWORD(NumberOfBytes) = 0;
  v8 = 0;
  *(_DWORD *)(a1 + 1160) = 3;
  *(_QWORD *)(a1 + 1104) = EtwpCompressionProc;
  *(_QWORD *)(a1 + 1112) = a1;
  *(_QWORD *)(a1 + 1088) = 0i64;
  result = RtlGetCompressionWorkSpaceSize(3u, (PULONG)&NumberOfBytes, &v8);
  v3 = result;
  if( result >= 0 )
  {
    if( !(_DWORD)NumberOfBytes
      || (v4 = ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)NumberOfBytes, 0x5A777445ui64),
          (*(_QWORD *)(a1 + 1144) = v4) != 0i64) )
    {
      *(_QWORD *)(a1 + 1128) = 0i64;
      *(_QWORD *)(a1 + 1200) = EtwpCompressionDpc;
      *(_DWORD *)(a1 + 1176) = 275;
      v5 = 0;
      *(_QWORD *)(a1 + 1208) = a1;
      *(_QWORD *)(a1 + 1232) = 0i64;
      *(_QWORD *)(a1 + 1192) = 0i64;
      *(_QWORD *)(a1 + 1168) = 0i64;
      if( *(_DWORD *)(a1 + 1156) )
      {
        while( 1 )
        {
          PoolWithTag = ExAllocatePoolWithTag((_POOL_TYPE)*(_DWORD *)(a1 + 316), 0x48ui64, 0x42777445ui64);
          if( !PoolWithTag )
            break;
          PoolWithTag[11] = 6;
          ++v5;
          *((_QWORD *)PoolWithTag + 4) = *(_QWORD *)(a1 + 1168);
          *(_QWORD *)(a1 + 1168) = PoolWithTag + 8;
          if( v5 >= *(_DWORD *)(a1 + 1156) )
            goto LABEL_8;
        }
        v3 = -1073741801;
        EtwpFreePlaceholderList(a1);
      }
      else
      {
LABEL_8:
        _InterlockedExchange((volatile __int32 *)(a1 + 1152), 1);
      }
      return v3;
    }
    else
    {
      return -1073741801;
    }
  }
  return result;
}

Referenced by: