EtwpAddNotificationEvent

NTSTATUS __stdcall EtwpAddNotificationEvent(PVOID EventHandle, UINT8 Wow64){
  NTSTATUS v3; 
  _ADAPTER_OBJECT *v4; 
  NTSTATUS v5; 
  VOID **v6; 
  volatile signed __int64 *v7; 
  PADAPTER_OBJECT DmaAdapter; 

  DmaAdapter = 0i64;
  v3 = ObReferenceObjectByHandle(EventHandle, 2ui64, (_OBJECT_TYPE *)ExEventObjectType, 1, (VOID **)&DmaAdapter, 0i64);
  v4 = DmaAdapter;
  v5 = v3;
  if( v3 >= 0 )
  {
    v6 = EtwpAddDataSource((__int64)KeGetCurrentThread()->ApcState.Process);
    v7 = (volatile signed __int64 *)v6;
    if( v6 )
    {
      if( Wow64 )
        v7 = (volatile signed __int64 *)(v6 + 1);
      if( _InterlockedCompareExchange64(v7, (signed __int64)v4, 0i64) )
        v5 = -1073740008;
      else
        v4 = 0i64;
    }
    else
    {
      v5 = -1073741801;
    }
  }
  if( v4 )
    HalPutDmaAdapter(v4);
  return v5;
}

Referenced by: