EtwpSetSoftRestartInformation

NTSTATUS __fastcall EtwpSetSoftRestartInformation(__int64 a1, unsigned int a2){
  NTSTATUS result; 
  UINT64 v5; 
  _ETHREAD *CurrentThread; 
  _WMI_LOGGER_CONTEXT *v7; 
  _WMI_LOGGER_CONTEXT *v8; 
  NTSTATUS v9; 
  VOID **SoftRestartContext; 
  char v11; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING UserString[3]; 

  DestinationString = 0i64;
  UserString[0] = 0i64;
  if( !EtwpKsrCallbackObject || PsIsCurrentThreadInServerSilo() )
    return -1073741637;
  if( a2 < 0x18 )
    return -1073741811;
  RtlInitUnicodeString(&DestinationString, 0i64);
  UserString[0].Buffer = (wchar_t *)(a1 + 18);
  UserString[0].Length = a2 - 18;
  UserString[0].MaximumLength = a2 - 18;
  if( (_WORD)a2 == 18 || (result = EtwpCaptureString(UserString, &DestinationString), result >= 0) )
  {
    v11 = *(_BYTE *)(a1 + 16);
    v5 = (unsigned __int16)*(_QWORD *)(a1 + 8);
    if( (_DWORD)v5 == 0xFFFF )
      v5 = *(unsigned __int8 *)(EtwpHostSiloState + 4208);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v7 = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)EtwpHostSiloState, v5, 1u);
    v8 = v7;
    if( !v7 )
    {
      v9 = -1073741162;
      goto LABEL_32;
    }
    v9 = EtwpCheckLoggerControlAccess(0x80ui64, v7);
    if( v9 >= 0 )
    {
      SoftRestartContext = (VOID **)v8->SoftRestartContext;
      if( !v11 )
      {
        if( SoftRestartContext && *((_BYTE *)SoftRestartContext + 32) )
        {
          EtwpCancelMemoryPreservation(v8);
          RtlFreeAnsiString((_UNICODE_STRING *)SoftRestartContext + 1);
          *((_BYTE *)SoftRestartContext + 32) = 0;
          v9 = 0;
        }
        else
        {
          v9 = -1073741054;
        }
        goto LABEL_32;
      }
      if( !SoftRestartContext )
      {
        SoftRestartContext = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1266119749i64);
        if( !SoftRestartContext )
        {
          v9 = -1073741801;
          goto LABEL_32;
        }
        *(_OWORD *)SoftRestartContext = 0i64;
        *((_OWORD *)SoftRestartContext + 1) = 0i64;
        SoftRestartContext[4] = 0i64;
        v8->SoftRestartContext = (struct _ETW_SOFT_RESTART_CONTEXT *)SoftRestartContext;
      }
      if( *((_BYTE *)SoftRestartContext + 32) )
      {
        v9 = -1073741053;
      }
      else if( DestinationString.Length )
      {
        if( (v8->LoggerMode & 0x400) == 0 || v8->PoolType == PagedPool || (v8->BufferSize & 0xFFF) != 0 )
        {
          v9 = -1073741637;
        }
        else
        {
          *((_UNICODE_STRING *)SoftRestartContext + 1) = DestinationString;
          DestinationString.Buffer = 0i64;
          *((_BYTE *)SoftRestartContext + 32) = 1;
          v9 = 0;
          if( EtwpKsrPrepared )
          {
            v9 = EtwpPreserveLogger(v8);
            if( v9 < 0 )
            {
              *((_BYTE *)SoftRestartContext + 32) = 0;
              RtlFreeAnsiString((_UNICODE_STRING *)SoftRestartContext + 1);
            }
          }
        }
      }
      else
      {
        v9 = -1073741672;
      }
    }
LABEL_32:
    if( v8 )
      EtwpReleaseLoggerContext(v8, 1u);
    RtlFreeAnsiString(&DestinationString);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return v9;
  }
  return result;
}

Referenced by: