EtwpGetSoftRestartInformation

__int64 __fastcall EtwpGetSoftRestartInformation(__int64 a1, unsigned int a2, _DWORD *a3){
  char v6; 
  UINT64 v8; 
  _ETHREAD *CurrentThread; 
  _WMI_LOGGER_CONTEXT *v10; 
  _WMI_LOGGER_CONTEXT *v11; 
  NTSTATUS v12; 
  struct _ETW_SOFT_RESTART_CONTEXT *SoftRestartContext; 

  v6 = 0;
  if( !EtwpKsrCallbackObject || PsIsCurrentThreadInServerSilo() )
    return 3221225659i64;
  *a3 = 24;
  if( a2 < 0x18 )
    return 3221225476i64;
  v8 = (unsigned __int16)*(_QWORD *)(a1 + 8);
  if( (_DWORD)v8 == 0xFFFF )
    v8 = *(unsigned __int8 *)(EtwpHostSiloState + 4208);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v10 = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)EtwpHostSiloState, v8, 1u);
  v11 = v10;
  if( v10 )
  {
    v12 = EtwpCheckLoggerControlAccess(1ui64, v10);
    if( v12 >= 0 )
    {
      SoftRestartContext = v11->SoftRestartContext;
      if( SoftRestartContext )
        v6 = *((_BYTE *)SoftRestartContext + 32);
    }
    EtwpReleaseLoggerContext(v11, 1u);
  }
  else
  {
    v12 = -1073741162;
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v12 >= 0 )
    *(_BYTE *)(a1 + 16) = v6;
  return(unsigned int)v12;
}

Referenced by: