ObQueryRefTraceInformation

NTSTATUS __stdcall ObQueryRefTraceInformation(
        VOID *SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnLength,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  UINT64 *v8; 
  unsigned int v9; 
  NTSTATUS v11; 
  unsigned int v12; 
  _ETHREAD *CurrentThread; 
  char v14; 
  unsigned __int16 v15; 
  char *v16; 
  __int16 v17; 
  unsigned int i; 
  unsigned int j; 
  __int64 v20; 

  v8 = ReturnLength;
  v9 = SystemInformationLength;
  v11 = 0;
  if( KeGetCurrentThread()->PreviousMode )
    ProbeForWrite((UINT64)SystemInformation, (unsigned int)SystemInformationLength, 8i64);
  v12 = 40;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C25A40, 0i64);
  v14 = ObpTraceFlags;
  if( (ObpTraceFlags & 2) != 0 )
  {
    v15 = 0;
    if( (ObpTraceFlags & 0x20) != 0 )
      v12 = stru_140C259D0.Length + 42;
    if( (ObpTraceFlags & 0x10) != 0 )
    {
      while( v15 < 0x10u && dword_140C25940[v15] )
        ++v15;
      if( v15 )
        v12 += 10 * v15;
    }
    if( v12 <= v9 )
    {
      v16 = (char *)SystemInformation + 40;
      *(_OWORD *)SystemInformation = 0i64;
      *((_OWORD *)SystemInformation + 1) = 0i64;
      *((_QWORD *)SystemInformation + 4) = 0i64;
      *(_BYTE *)SystemInformation = 1;
      *((_BYTE *)SystemInformation + 1) = (ObpTraceFlags & 0x40) != 0;
      if( (v14 & 0x20) != 0 )
      {
        *((_WORD *)SystemInformation + 4) = stru_140C259D0.Length;
        *((_WORD *)SystemInformation + 5) = stru_140C259D0.MaximumLength;
        *((_QWORD *)SystemInformation + 2) = v16;
        memmove((char *)SystemInformation + 40, stru_140C259D0.Buffer, stru_140C259D0.MaximumLength);
        v16 += 2 * ((unsigned __int64)stru_140C259D0.MaximumLength >> 1);
      }
      if( (ObpTraceFlags & 0x10) != 0 )
      {
        v17 = 2 * (5 * v15 - 1);
        *((_WORD *)SystemInformation + 12) = v17;
        *((_WORD *)SystemInformation + 13) = v17 + 2;
        *((_QWORD *)SystemInformation + 4) = v16;
        for( i = 0; i < v15; ++i )
        {
          for( j = 0; ; ++j )
          {
            v20 = j + 5 * i;
            if( j >= 4 )
              break;
            *(_WORD *)&v16[2 * v20] = (unsigned __int8)(dword_140C25940[i] >> (8 * j));
          }
          *(_WORD *)&v16[2 * v20] = 59;
        }
        *(_WORD *)&v16[10 * v15 - 2] = 0;
      }
      v8 = ReturnLength;
    }
    else
    {
      v11 = -1073741820;
      v8 = ReturnLength;
    }
  }
  else if( v9 >= 0x28 )
  {
    *(_BYTE *)SystemInformation = 0;
  }
  else
  {
    v11 = -1073741820;
  }
  if( (_InterlockedExchangeAdd64(&stru_140C25A40._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C25A40);
  KeAbPostRelease(&stru_140C25A40);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  if( (int)(v11 + 0x80000000) < 0 || v11 == -1073741820 )
  {
    if( v8 )
      *(_DWORD *)v8 = v12;
  }
  return v11;
}

Referenced by: