WmipProcessLegacyEtwRegister
LONG __fastcall WmipProcessLegacyEtwRegister(__int64 a1, __int64 a2){
__int64 v4;
UINT64 v5;
LONG result;
int v7;
union _LARGE_INTEGER v8;
KeWaitForSingleObject(&WmipSMMutex, Executive, 0, 0, 0i64);
v4 = *(_QWORD *)(a1 + 112);
if( v4 == a2 )
*(_QWORD *)(a1 + 112) = -1i64;
v5 = *(_QWORD *)(a1 + 104);
*(_QWORD *)(a1 + 104) = 0i64;
v8.QuadPart = v5;
result = KeReleaseMutex(&WmipSMMutex, 0);
if( v5 )
result = EtwUnregister(v5);
if( v4 == a2 )
{
v7 = EtwRegisterClassicProvider(
a1 + 72,
0i64,
(void(__fastcall *)(_QWORD *, __int64, __int16 *, __int64))WmipLegacyEtwCallback,
a1,
&v8);
KeWaitForSingleObject(&WmipSMMutex, Executive, 0, 0, 0i64);
if( v7 < 0 )
*(_QWORD *)(a1 + 112) = 0i64;
else
*(union _LARGE_INTEGER *)(a1 + 104) = v8;
return KeReleaseMutex(&WmipSMMutex, 0);
}
return result;
}Referenced by:
WmipLegacyEtwWorker