EtwpTrackDecodeGuidForSession

BOOL __fastcall EtwpTrackDecodeGuidForSession(INT64 a1, INT64 a2){
  __int64 v2; 
  volatile INT64 *v3; 
  __int64 v4; 
  bool v6; 
  _QWORD *i; 
  __int64 v8; 
  unsigned int v9; 
  char *PoolWithTag; 
  __int128 v11; 
  BOOL result; 
  __int64 v13; 
  v2 = *(_QWORD *)(a2 + 104);
  v3 = (volatile INT64 *)(a1 + 704);
  v4 = *(_QWORD *)(a2 + 32);
  v6 = 0;
  ExAcquirePushLockExclusiveEx(a1 + 704, 0i64);
  for( i = *(_QWORD **)(a1 + 128); ; i = (_QWORD *)*i )
  {
    if( !i )
    {
      v9 = *(_DWORD *)(a1 + 340) + 2048;
      if( v9 <= *(_DWORD *)(a1 + 4) && v9 <= 0x10000 )
      {
        PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0x30ui64, 0x62777445ui64);
        if( PoolWithTag )
        {
          *(_QWORD *)PoolWithTag = *(_QWORD *)(a1 + 128);
          *(_OWORD *)(PoolWithTag + 8) = *(_OWORD *)(v2 + 34);
          v11 = *(_OWORD *)(v4 + 40);
          PoolWithTag[40] = 0;
          *(_OWORD *)(PoolWithTag + 24) = v11;
          ++*(_DWORD *)(a1 + 136);
          *(_DWORD *)(a1 + 340) += 32;
          *(_QWORD *)(a1 + 128) = PoolWithTag;
          _InterlockedOr((volatile signed __int32 *)(a1 + 836), 0x8C0u);
          v6 = 1;
        }
      }
      goto LABEL_11;
    }
    v8 = *(_QWORD *)(v2 + 34) - i[1];
    if( !v8 )
      v8 = *(_QWORD *)(v2 + 42) - i[2];
    if( !v8 )
      break;
  }
  v13 = *(_QWORD *)(v4 + 40) - i[3];
  if( !v13 )
    v13 = *(_QWORD *)(v4 + 48) - i[4];
  v6 = v13 == 0;
LABEL_11:
  if( (_InterlockedExchangeAdd64(v3, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v3);
  KeAbPostRelease((PVOID)v3);
  LOBYTE(result) = v6;
  return result;
}

Referenced by: