EtwpReferenceLoggerSecurityDescriptor

volatile INT64 *__fastcall EtwpReferenceLoggerSecurityDescriptor(INT64 a1){
  signed __int64 v2; 
  signed __int64 v3; 
  int v4; 
  volatile INT64 *v5; 
  signed __int64 v7; 
  signed __int64 v8; 
  _ETHREAD *CurrentThread; 
  _m_prefetchw((const void *)(a1 + 800));
  v2 = *(_QWORD *)(a1 + 800);
  if( (v2 & 0xF) != 0 )
  {
    do
    {
      v3 = _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 800), v2 - 1, v2);
      if( v2 == v3 )
        break;
      v2 = v3;
    }
    while( (v3 & 0xF) != 0 );
  }
  v4 = v2 & 0xF;
  if( (v2 & 0xF) != 0 )
  {
    v5 = (volatile INT64 *)(v2 & 0xFFFFFFFFFFFFFFF0ui64);
    if( v4 == 1 )
    {
      if( _InterlockedExchangeAdd64(v5 - 3, 0xFui64) <= 0 )
        __fastfail(0xEu);
      _m_prefetchw((const void *)(a1 + 800));
      v7 = *(_QWORD *)(a1 + 800);
      while( (unsigned __int64)(v7 & 0xF) + 15 <= 0xF && v5 == (volatile INT64 *)(v7 & 0xFFFFFFFFFFFFFFF0ui64) )
      {
        v8 = v7;
        v7 = _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 800), v7 + 15, v7);
        if( v8 == v7 )
          return v5;
      }
      ObDereferenceSecurityDescriptor((PVOID)v5, 0xFui64);
    }
  }
  else
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockSharedEx((UINT64)&EtwpSecurityLock, 0i64);
    v5 = (volatile INT64 *)(*(_QWORD *)(a1 + 800) & 0xFFFFFFFFFFFFFFF0ui64);
    if( _InterlockedExchangeAdd64(v5 - 3, 1ui64) <= 0 )
      __fastfail(0xEu);
    if( _InterlockedCompareExchange64((volatile signed __int64 *)&EtwpSecurityLock, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((INT64 *)&EtwpSecurityLock);
    KeAbPostRelease(&EtwpSecurityLock);
    KeLeaveCriticalRegion();
  }
  return v5;
}

Referenced by: